Loading vulnerability…
CVE-2017-15944 is a remote code execution vulnerability affecting Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6. According to the provided content, the flaw allows remote attackers to execute arbitrary code via vectors involving the PAN-OS management interface. The specific vulnerable function or code path is not provided in the supplied material, so more granular root-cause detail is currently not available.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (panos_readsessionvars.rb) that exploits a chain of vulnerabilities (CVE-2017-15944) in Palo Alto Networks PAN-OS prior to versions 6.1.19, 7.0.19, 7.1.14, and 8.0.6. The exploit leverages an authentication bypass and XML injection to create an arbitrary directory, then abuses a cron job to execute a staged payload as root. The module is written in Ruby and is structured as a typical Metasploit exploit, using the HttpClient and FileDropper mixins. The attacker must provide a callback host and port to receive a reverse shell, which is staged via an openssl s_client connection. The exploit targets the device's HTTPS management interface and requires up to 20 minutes for the cron job to trigger. The main endpoints involved are /esp/cms_changeDeviceContext.esp and /php/utils/router.php/Administrator.get, and the payload is staged in /opt/pancfg/mgmt/logdb/traffic/1/ on the target. The exploit is operational and provides root code execution if successful.
This repository contains a proof-of-concept (POC) exploit for CVE-2017-15944, a remote root code execution vulnerability in Palo Alto Networks PAN-OS firewalls. The repository consists of a Python script (panos-poc.py) and a README file. The script takes a target URL (HTTP or HTTPS) as input, sends crafted requests to the /esp/cms_changeDeviceContext.esp endpoint to attempt exploitation, and then checks the /php/utils/debug.php endpoint for the presence of a 'Debug Console' string as an indicator of successful exploitation. The exploit is network-based and targets accessible PAN-OS devices. The code is a POC and does not provide a full shell or advanced payload, but demonstrates the vulnerability and verifies its presence.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.