Is CVE-2019-17440 in the CISA KEV catalog?

No. CVE-2019-17440 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2019-17440?

CVE-2019-17440 has a CVSS v3 base score of 10.0 (CRITICAL).

What is the EPSS score for CVE-2019-17440?

CVE-2019-17440 has an EPSS score of 1.68% (74th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix or mitigate CVE-2019-17440?

No published fix for CVE-2019-17440 has been found yet. Check the linked vendor advisories for guidance as it becomes available.

CVE & CISA-KEV Catalog

CVE-2019-17440

CRITICALEPSS 74th pctl

10.0

CVSS v3

NVD

Description

Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 versions prior to 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC installed and configured. This issue does not affect PA-7000 Series deployments using the first-generation SMC and the Log Processing Card (LPC). This issue does not affect any other PA series devices. This issue does not affect devices without an LFC. This issue does not affect PAN-OS 8.1 or prior releases. This issue only affected a very limited number of customers and we undertook individual outreach to help them upgrade. At the time of publication, all identified customers have upgraded SW or content and are not impacted.

CWE-923

How to fix

No published remediation has been found for this vulnerability's affected products yet.

Mitigation guidance may be in the linked vendor advisories in the References section below.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeChanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploit Intelligence

1.68%probability of exploitation in 30 days

74thpercentile

Elevated risk: more likely to be exploited than 74% of all known CVEs.

References

Other references1

security.paloaltonetworks.com

Embed a live status badge for CVE-2019-17440

Markdown

[![CVE-2019-17440](https://tridentstack.com/cve/badge/CVE-2019-17440.svg)](https://tridentstack.com/cve/CVE-2019-17440)

HTML

<a href="https://tridentstack.com/cve/CVE-2019-17440"><img src="https://tridentstack.com/cve/badge/CVE-2019-17440.svg" alt="CVE-2019-17440"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.