What is CVE-2020-1979?

CVE-2020-1979 is a high-severity vulnerability in Palo Alto Networks Pan-Os, classified under Use of Externally-Controlled Format String. CVSS score: 8.1/10. Published 2020-03-11.

How severe is CVE-2020-1979?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Palo Alto Networks Pan-Os

CVE-2020-1979

A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13 on Panorama. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions.

EPSS: 0.010 (59.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Palo Alto Networks Pan-os — versions 8.1, 9.0.0, 7.1.0
Paloaltonetworks Pan-os

Weakness classification (CWE)

CWE-134 — Use of Externally-Controlled Format String

References

psirt@paloaltonetworks.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-1979?: CVE-2020-1979 is a high-severity vulnerability in Palo Alto Networks Pan-Os, classified under Use of Externally-Controlled Format String. CVSS score: 8.1/10. Published 2020-03-11.
How severe is CVE-2020-1979?: High severity. CVSS v3 base score is 8.1 out of 10.