Palo Alto Networks Patch Party: Zero-Day Bugs Squashed in Operation Lunar Peek! 🚀🔒
Palo Alto Networks has patched two zero-days, CVE-2024-0012 and CVE-2024-9474, exploited in Operation Lunar Peek. These vulnerabilities affected PAN-OS firewalls, allowing attackers to gain admin and root privileges. To reduce risk, ensure the management interface is accessible only from trusted IPs. CISA urges addressing these flaws by December 9.
Hot Take:
Looks like the cybercriminals are moonlighting in “Operation Lunar Peek,” and it seems they’ve figured out how to bypass more than just firewalls—they’re bypassing bedtime, too. Palo Alto Networks plays the role of the weary parent trying to catch them in the act, only to find out their kids have been raiding the cookie jar… of admin privileges.
Key Points:
- Palo Alto Networks released patches for two zero-day vulnerabilities exploited in “Operation Lunar Peek.”
- Zero-day CVE-2024-0012 allows unauthenticated admin access via the PAN-OS management interface.
- CVE-2024-9474 lets attackers with admin permissions gain root privileges on the firewall.
- Updates for PAN-OS 11.2, 11.1, 11.0, 10.2, and 10.1 have been released to patch these vulnerabilities.
- The Shadowserver Foundation reported a decline in internet-exposed PAN-OS interfaces from 11,000 to 6,600 IPs.
Already a member? Log in here