CVE-2024-9469
Improper Check for Unusual or Exceptional Conditions (CWE-754)
Summary
A vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a user with non-administrative privileges to disable the agent. This issue stems from a problem with a detection mechanism in the agent.
Impact
This vulnerability could be exploited by malware to disable the Cortex XDR agent, allowing subsequent malicious activity to go undetected. The impact is primarily on the availability of the security agent, potentially leaving the system exposed to further attacks without proper monitoring or protection.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Palo Alto Networks has released updated versions to address this vulnerability.
Mitigation
1. Update Cortex XDR agent to the latest patched version. 2. For version 7.9-ce, upgrade to version 7.9.102-ce or later. 3. For versions 8.3.0 and 8.4.0, check with Palo Alto Networks for the specific patched versions. 4. Implement the principle of least privilege to limit the number of users with the ability to potentially exploit this vulnerability. 5. Monitor for any suspicious activity or attempts to disable the Cortex XDR agent. 6. Consider implementing additional security controls to detect and prevent unauthorized changes to security software.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Timeline
NVD published the first details for CVE-2024-9469
A CVSS base score of 5.7 has been assigned.
Feedly found the first article mentioning CVE-2024-9469. See article
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.04% (Percentile: 9.7%)
A CVSS base score of 5.5 has been assigned.