CVE-2024-5909
Improper Privilege Management (CWE-269)
Summary
A vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. The vulnerability affects Cortex XDR agent versions 7.9 (versions prior to 7.9.102), 8.1 (versions prior to 8.1.2), and 8.2 (versions prior to 8.2.1).
Impact
If exploited, this vulnerability could allow malware or an attacker with low privileges on a Windows system to disable the Cortex XDR security agent. This would prevent the agent from detecting and reporting malicious activity, leaving the system unprotected and enabling further attacks or malware execution. The CVSS v3.1 base score is 5.5 (Medium), with high impact on availability but no direct impact on confidentiality or integrity. The attack vector is local, requires low privileges, and no user interaction.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
While not explicitly stated, the vulnerability data implies that patched versions are available. Users should update to Cortex XDR agent versions 7.9.102 or later for the 7.9 branch, 8.1.2 or later for the 8.1 branch, and 8.2.1 or later for the 8.2 branch.
Mitigation
1. Update all Windows systems running the Palo Alto Networks Cortex XDR agent to the latest patched version (7.9.102+, 8.1.2+, or 8.2.1+ depending on the branch). 2. Review and tighten security policies and permissions to prevent low privileged users from disabling or stopping the security agent processes. 3. Implement monitoring systems to detect any unauthorized modifications to the Cortex XDR agent. 4. Consider implementing additional security layers to compensate for potential Cortex XDR agent disabling.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Timeline
NVD published the first details for CVE-2024-5909
Feedly found the first article mentioning CVE-2024-5909. See article
Feedly estimated the CVSS score as MEDIUM
This CVE started to trend in security discussions
EPSS Score was set to: 0.04% (Percentile: 9%)
This CVE stopped trending in security discussions