Loading vulnerability…
CVE-2017-15944 is a remote code execution vulnerability affecting the management interface of Palo Alto Networks PAN-OS. Affected releases include PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6. Remote attackers can execute arbitrary code through vectors involving the management interface. This vulnerability is distinct from the separately documented GlobalProtect SSL VPN format-string vulnerability.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (panos_readsessionvars.rb) that exploits a chain of vulnerabilities (CVE-2017-15944) in Palo Alto Networks PAN-OS prior to versions 6.1.19, 7.0.19, 7.1.14, and 8.0.6. The exploit leverages an authentication bypass and XML injection to create an arbitrary directory, then abuses a cron job to execute a staged payload as root. The module is written in Ruby and is structured as a typical Metasploit exploit, using the HttpClient and FileDropper mixins. The attacker must provide a callback host and port to receive a reverse shell, which is staged via an openssl s_client connection. The exploit targets the device's HTTPS management interface and requires up to 20 minutes for the cron job to trigger. The main endpoints involved are /esp/cms_changeDeviceContext.esp and /php/utils/router.php/Administrator.get, and the payload is staged in /opt/pancfg/mgmt/logdb/traffic/1/ on the target. The exploit is operational and provides root code execution if successful.
This repository contains a proof-of-concept (POC) exploit for CVE-2017-15944, a remote root code execution vulnerability in Palo Alto Networks PAN-OS firewalls. The repository consists of a Python script (panos-poc.py) and a README file. The script takes a target URL (HTTP or HTTPS) as input, sends crafted requests to the /esp/cms_changeDeviceContext.esp endpoint to attempt exploitation, and then checks the /php/utils/debug.php endpoint for the presence of a 'Debug Console' string as an indicator of successful exploitation. The exploit is network-based and targets accessible PAN-OS devices. The code is a POC and does not provide a full shell or advanced payload, but demonstrates the vulnerability and verifies its presence.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prior Palo Alto PAN-OS management-interface vulnerability mentioned only as background; it is not the subject of this reference and is stated not to concern GlobalProtect.
A Palo Alto PAN-OS remote code execution vulnerability for which UNC3569 downloaded scanner/exploit tooling.
An older PAN-OS vulnerability cited as an example of ongoing exploit activity that may signal forthcoming vulnerability disclosures affecting the same product. The report does not describe its technical mechanism or confirm successful compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.