CVE-2020-2001 is a critical vulnerability affecting Palo Alto Networks PAN-OS Panorama versions 7.1, 8.0, and specific 8.1 and 9.0 versions. It allows an unauthenticated attacker with network access to the PAN-OS management interface to write arbitrary files and elevate privileges due to an external control of path and data flaw in the XSLT processing logic. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a significant risk, enabling full compromise of confidentiality, integrity, and availability without user interaction. Despite its severity, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it has not been added to CISA's KEV catalog, nor has it garnered significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.1.0, <= 7.1.26CPE matchmatch criteria | cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* | ||
>= 8.0.0, <= 8.0.20CPE matchmatch criteria | cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* | ||
>= 8.1.0, < 8.1.12CPE matchmatch criteria | cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* | ||
>= 9.0.0, < 9.0.6CPE matchmatch criteria | cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* | ||
>= 8.1, < 8.1.12CPE match | cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.