CVE-2024-3387

Description

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.

Overview

State: PUBLISHED
Assigner (CNA): palo_alto
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-326
Reserved: 2024-04-05
Published: 2024-04-10 17:06 UTC
Last updated: 2024-08-01 20:12 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3387.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2024-04-10 17:15:57 UTC
NVD last modified: 2026-01-30 21:13:20 UTC
NVD CVSS v3.1: 5.3 / 10 MEDIUM source: psirt@paloaltonetworks.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitability subscore: 1.6 / 10
Impact subscore: 3.6 / 10
EPSS score: 0.0013 (probability of exploitation in next 30 days)
EPSS percentile: 31.40% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2024-31976
Assigner: palo_alto
Published: Apr 10, 2024, 5:06:36 PM
Updated: Aug 1, 2024, 8:12:06 PM
EUVD base score (CVSS 3.1): 5.3 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EUVD-reported EPSS: 0.1300
Vendors: Palo Alto Networks
Products: PAN-OS (11.0.0 <11.0.4)

PAN-OS (10.1.0 <10.1.12)

PAN-OS

Cloud NGFW

PAN-OS (10.2.0 <10.2.8)

Prisma Access

PAN-OS (10.2.0 <10.2.7-h3)
Aliases: GHSA-hcgv-gpgg-9mmm

ENISA description: A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.

EUVD references (1)

https://security.paloaltonetworks.com/CVE-2024-3387

Affected products (3)

Vendor	Product	Versions	Platforms
Palo Alto Networks	PAN-OS	`9.0.0` (unaffected), `9.1.0` (unaffected), `10.1.0` (affected), `10.2.0` (affected), `10.2.0` (affected), `11.0.0` (affected), `11.1.0` (unaffected)	—
Palo Alto Networks	Cloud NGFW	`All` (unaffected)	—
Palo Alto Networks	Prisma Access	`All` (unaffected)	—

Affected products — CPE 2.3 (7) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://security.paloaltonetworks.com/CVE-2024-3387

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/326.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2024-3387 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-31976 rapid7:euvd.enisa.europa.eu
https://security.paloaltonetworks.com/CVE-2024-3387 rapid7:security.paloaltonetworks.com
https://www.cve.org/CVERecord?id=CVE-2024-3387 rapid7:www.cve.org

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://security.paloaltonetworks.com/CVE-2024-3387 psirt@paloaltonetworks.com Vendor Advisory
https://security.paloaltonetworks.com/CVE-2024-3387 af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory

Remediations (10)

OpenSSH CVE-2024-6387 RCE Vulnerability: Risk & Mitigation | Qualys

web:blog.qualys.com

CVE - 2024 -6387 exploit in OpenSSH poses remote unauthenticated code execution risks. Find out which versions are vulnerable and how to protect your systems.

2026-05-23 22:06 UTC
GitHub - Karmakstylez/CVE-2024-6387: Remote Unauthenticated Code ...

web:github.com

Remote Unauthenticated Code Execution Vulnerability in OpenSSH server CVE - 2024 -6387.py is a lightweight, efficient tool designed to identify servers running vulnerable versions of OpenSSH, specifically targeting the recently discovered regreSSHion vulnerability ( CVE - 2024 -6387). This script facilitates rapid scanning of multiple IP addresses, domain names, and CIDR network ranges to detect ...

2026-05-23 22:06 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 22:06 UTC
Critical OpenSSH Flaw Exposes Millions of Servers: RegreSSHion CVE-2024 ...

web:undercodetesting.com

What Undercode Say: Key Takeaway 1: CVE - 2024 -6387 highlights how old vulnerabilities can resurface due to code regressions, emphasizing the need for rigorous regression testing in security-critical components. Key Takeaway 2: Mitigation must balance security and usability; reducing login grace time and connection limits can impede exploits but may affect legitimate users in high-traffic ...

2026-05-23 22:06 UTC
CVE Record: CVE-2024-6387

web:www.cve.org

Vulnerability detail for CVE - 2024 -6387 Notice: Expanded keyword searching of CVE Records (with limitations) is now available in the search box above. Learn more here.

2026-05-23 22:06 UTC
CVE-2024-6387 Vulnerability: Analysis, Impact, Mitigation | Huntress

web:www.huntress.com

Mitigation & Remediation Strategies If you're running an affected version, stop what you're doing and patch . Now. This isn't a "wait and see" situation. Patch Immediately: This is the most effective CVE - 2024 -6387 vulnerability mitigation . Upgrade to OpenSSH 9.8p2, 9.9p1, or a later version provided by your OS vendor.

2026-05-23 22:06 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-23 22:06 UTC
Microsoft fixes 167 security flaws in April, second biggest Patch ...

web:www.pcworld.com

This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

2026-05-23 22:06 UTC
OpenSSH regreSSHion CVE-2024-6387 Vulnerability: Exploitation & Mitigation

web:www.picussecurity.com

CVE - 2024 -6387 regreSSHion vulnerability allows for RCE in OpenSSH, impacting millions of servers. Learn about its critical risks and immediate mitigation steps.

2026-05-23 22:06 UTC
Windows 11 April 2026 Update tested: What's new, improved and fixed

web:www.windowslatest.com

Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

2026-05-23 22:06 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2024-3387.json.

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pan-os",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "status": "affected",
                "version": "10.2.2"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:paloaltonetworks:pan-os:10.1.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pan-os",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "status": "affected",
                "version": "10.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pan-os",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "status": "affected",
                "version": "11.0.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-19T19:33:54.917377Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:31:52.758Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:12:06.646Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2024-3387"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "9.0.0"
            },
            {
              "status": "unaffected",
              "version": "9.1.0"
            },
            {
              "changes": [
                {
                  "at": "10.1.12",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.1.12",
              "status": "affected",
              "version": "10.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "10.2.7-h3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.2.7-h3",
              "status": "affected",
              "version": "10.2.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "10.2.8",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.2.8",
              "status": "affected",
              "version": "10.2.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "11.0.4",
                  "status": "unaffected"
                }
              ],
              "lessThan": "11.0.4",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "11.1.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cloud NGFW",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Prisma Access",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Palo Alto Networks thanks one of our customers for discovering and reporting this issue."
        }
      ],
      "datePublic": "2024-04-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls."
            }
          ],
          "value": "A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.<br>"
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-20",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-20 Encryption Brute Forcing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-326",
              "description": "CWE-326 Inadequate Encryption Strength",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-10T17:06:36.676Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "url": "https://security.paloaltonetworks.com/CVE-2024-3387"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in PAN-OS 10.1.12, PAN-OS 10.2.7-h3, PAN-OS 10.2.8, PAN-OS 11.0.4, and all later PAN-OS versions.<br>"
            }
          ],
          "value": "This issue is fixed in PAN-OS 10.1.12, PAN-OS 10.2.7-h3, PAN-OS 10.2.8, PAN-OS 11.0.4, and all later PAN-OS versions.\n"
        }
      ],
      "source": {
        "defect": [
          "PAN-200047"
        ],
        "discovery": "USER"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-10T16:00:00.000Z",
          "value": "Initial publication"
        }
      ],
      "title": "PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2024-3387",
    "datePublished": "2024-04-10T17:06:36.676Z",
    "dateReserved": "2024-04-05T17:40:19.884Z",
    "dateUpdated": "2024-08-01T20:12:06.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}