ByteOS

Product

PAN-OS

Default Status

unaffected

Versions

Affected

From 8.1 before 8.1.24-h1 (custom)
- -> unaffectedfrom8.1.24-h1
From 9.0 before 9.0.17 (custom)
- -> unaffectedfrom9.0.17
From 9.1 before 9.1.12 (custom)
- -> unaffectedfrom9.1.12
From 10.0 before 10.0.9 (custom)
- -> unaffectedfrom10.0.9
From 10.1 before 10.1.3 (custom)
- -> unaffectedfrom10.1.3

Unaffected

From 10.2 before All (custom)
From 11.0 before All (custom)
From 11.1 before All (custom)

Vendor

Product

Prisma Access

Default Status

unaffected

Versions

Unaffected

Vendor

Product

Cloud NGFW

Default Status

unaffected

Versions

Unaffected

Problem Types

Type	CWE ID	Description
CWE	CWE-78	CWE-78 OS Command Injection

Type: CWE

CWE ID: CWE-78

Description: CWE-78 OS Command Injection

Metrics

Version	Base score	Base severity	Vector
3.1	5.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Solutions

This issue is fixed in PAN-OS 8.1.24-h1, PAN-OS 9.0.17, PAN-OS 9.1.12, PAN-OS 10.0.9, PAN-OS 10.1.3, and all later PAN-OS versions.

Workarounds

This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices.

Exploits

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Timeline

Event	Date
Initial publication	2023-12-13 17:00:00

Event: Initial publication

Date: 2023-12-13 17:00:00

References

Hyperlink	Resource
https://security.paloaltonetworks.com/CVE-2023-6795	N/A

Hyperlink: https://security.paloaltonetworks.com/CVE-2023-6795

Resource: N/A

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://security.paloaltonetworks.com/CVE-2023-6795	x_transferred

Hyperlink: https://security.paloaltonetworks.com/CVE-2023-6795

Resource:

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@paloaltonetworks.com

Published At:13 Dec, 2023 | 19:15

Updated At:18 Dec, 2023 | 18:41

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Secondary	3.1	5.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Type: Primary

Version: 3.1

Base score: 4.7

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

CPE Matches

>>pan-os>>Versions from 8.1.0(inclusive) to 8.1.24(exclusive)

>>pan-os>>Versions from 9.0.0(inclusive) to 9.0.17(exclusive)

>>pan-os>>Versions from 9.1.0(inclusive) to 9.1.12(exclusive)

>>pan-os>>Versions from 10.0.0(inclusive) to 10.0.9(exclusive)

>>pan-os>>Versions from 10.1.0(inclusive) to 10.1.3(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-78	Primary	nvd@nist.gov
CWE-78	Secondary	psirt@paloaltonetworks.com

CWE ID: CWE-78

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-78

Type: Secondary

Source: psirt@paloaltonetworks.com

References

Hyperlink	Source	Resource
https://security.paloaltonetworks.com/CVE-2023-6795	psirt@paloaltonetworks.com	Vendor Advisory

Hyperlink: https://security.paloaltonetworks.com/CVE-2023-6795

Source: psirt@paloaltonetworks.com

Resource:

Vendor Advisory

Similar CVEs

108Records found

CVE-2024-5340

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-5.1||MEDIUM

EPSS-0.42% / 60.92%

7 Day CHG-0.07%

Published-25 May, 2024 | 21:31

Updated-21 Aug, 2025 | 18:07

Ruijie RG-UAC sub_commit.php os command injection

A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266246 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-5339

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-5.1||MEDIUM

EPSS-0.27% / 49.73%

7 Day CHG-0.04%

Published-25 May, 2024 | 16:31

Updated-21 Aug, 2025 | 18:07

Ruijie RG-UAC online_check.php os command injection

A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/vpn/autovpn/online_check.php. The manipulation of the argument peernode leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-5338

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-5.1||MEDIUM

EPSS-0.27% / 49.73%

7 Day CHG-0.04%

Published-25 May, 2024 | 15:31

Updated-21 Aug, 2025 | 18:07

Ruijie RG-UAC online.php os command injection

A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been classified as critical. Affected is an unknown function of the file /view/vpn/autovpn/online.php. The manipulation of the argument peernode leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266244. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-5336

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-5.1||MEDIUM

EPSS-0.09% / 27.05%

7 Day CHG-0.01%

Published-25 May, 2024 | 14:31

Updated-21 Aug, 2025 | 18:07

Ruijie RG-UAC vlan_add_commit.php addVlan os command injection

A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical. This vulnerability affects the function addVlan of the file /view/networkConfig/vlan/vlan_add_commit.php. The manipulation of the argument phyport leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266242 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-4509

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-4.7||MEDIUM

EPSS-0.32% / 54.71%

7 Day CHG-0.06%

Published-06 May, 2024 | 00:31

Updated-21 Aug, 2025 | 18:21

Ruijie RG-UAC add_commit.php os command injection

A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/IPV6/naborTable/add_commit.php. The manipulation of the argument ip_addr/mac_addr leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263113 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-4502

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-4.7||MEDIUM

EPSS-0.31% / 53.38%

7 Day CHG+0.01%

Published-05 May, 2024 | 22:00

Updated-21 Aug, 2025 | 18:19

Ruijie RG-UAC dhcp_client_commit.php os command injection

A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428. Affected is an unknown function of the file /view/dhcp/dhcpClient/dhcp_client_commit.php. The manipulation of the argument ifName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263106 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-4504

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-4.7||MEDIUM

EPSS-0.31% / 53.38%

7 Day CHG-0.05%

Published-05 May, 2024 | 22:31

Updated-21 Aug, 2025 | 18:19

Ruijie RG-UAC commit.php os command injection

A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Affected by this issue is some unknown functionality of the file /view/HAconfig/baseConfig/commit.php. The manipulation of the argument peer_ip/local_ip leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263108. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-4505

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-4.7||MEDIUM

EPSS-0.33% / 55.57%

7 Day CHG+0.01%

Published-05 May, 2024 | 22:31

Updated-21 Aug, 2025 | 18:19

Ruijie RG-UAC ip_addr_add_commit.php os command injection

A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428. This affects an unknown part of the file /view/IPV6/ipv6Addr/ip_addr_add_commit.php. The manipulation of the argument prelen/ethname leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263109 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.