CVE-2024-5921

Estado: AnalizadaAlta (7.1)—

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.46%
Percentil entre todas las CVEs puntuadas: 73
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation60 %
Impacto principalT1557 Adversary-in-the-Middlecredential access · collection55 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Training Threat Intelligence Program Network Segmentation Network Intrusion Prevention Limit Access to Resource Over Network Filter Network Traffic

Tecnologías afectadas (1)

Paloaltonetworks — Globalprotect

CWE

CWE-295

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-5921",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-5921",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-27T04:55:17.649111Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@paloaltonetworks.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 7.1,
          "Automatable": "NO",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "AMBER",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.3.2",
                  "status": "unaffected"
                }
              ],
              "version": "6.3.0",
              "lessThan": "6.3.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.6",
                  "status": "unaffected"
                }
              ],
              "version": "6.2.0",
              "lessThan": "6.2.6",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.3.2",
                  "status": "unaffected"
                }
              ],
              "version": "6.3.0",
              "lessThan": "6.3.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.6-c857",
                  "status": "unaffected"
                }
              ],
              "version": "6.2.0",
              "lessThan": "6.2.6-c857",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "macOS"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.1-c31",
                  "status": "unaffected"
                }
              ],
              "version": "6.2.0",
              "lessThan": "6.2.1-c31",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.0",
              "lessThan": "6.1.6",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.1.7",
                  "status": "unaffected"
                }
              ],
              "version": "6.1.0",
              "lessThan": "6.1.7",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iOS"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "unaffected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "5.1.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "FIPS-CC mode"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.6",
                  "status": "unaffected"
                }
              ],
              "version": "6.2.0",
              "lessThan": "6.2.6",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows UWP"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-27T04:15:14.687",
  "references": [
    {
      "url": "https://blog.amberwolf.com/blog/2024/november/palo-alto-globalprotect---code-execution-and-privilege-escalation-via-malicious-vpn-server-cve-2024-5921/",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://github.com/AmberWolfCyber/NachoVPN",
      "tags": [
        "Not Applicable"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2024-5921",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@paloaltonetworks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.\n\nPlease subscribe to  our RSS feed https://security.paloaltonetworks.com/rss.xml  to be alerted to new updates to this and other advisories."
    },
    {
      "lang": "es",
      "value": "Un problema de validación de certificación insuficiente en la aplicación GlobalProtect de Palo Alto Networks permite a los atacantes conectar la aplicación GlobalProtect a servidores arbitrarios. Esto puede permitir que un usuario de sistema operativo local no administrativo o un atacante en la misma subred instale certificados raíz maliciosos en el endpoint y, posteriormente, instale software malicioso firmado por los certificados raíz maliciosos en ese endpoint. La aplicación GlobalProtect para Android está en evaluación. Suscríbase a nuestro canal RSS https://security.paloaltonetworks.com/rss.xml para recibir alertas sobre nuevas actualizaciones de este y otros avisos."
    }
  ],
  "lastModified": "2026-06-17T08:16:55.377",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3359D547-998E-47A1-BEDB-B2C77EF3A409",
              "versionEndExcluding": "6.1.6",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAD9B8B2-FF04-4DD8-A6CA-36D07E5E143C",
              "versionEndExcluding": "6.1.7",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "481B8617-1E9C-402D-A514-32789504E173",
              "versionEndExcluding": "6.2.1",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98AE3375-3394-4A30-B81C-17AEDF9F6870",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "444E9B22-3CD4-462F-A476-E65CC5307396",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "337C8091-22DB-4449-B042-8325C2FBD956",
              "versionEndExcluding": "6.3.2",
              "versionStartIncluding": "6.3.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37374EC1-2761-4204-B167-81AC7292D6B1",
              "versionEndExcluding": "6.3.2",
              "versionStartIncluding": "6.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}