CVE-2024-0008 is a Medium severity flaw in the PAN-OS management web interface, where sessions do not expire in certain situations. Palo Alto Networks fixed it in PAN-OS 9.0.17-h2, 9.1.17, 10.0.12-h1, 10.1.10-h1, 10.2.5, 11.0.2 and later. Upgrade, and enforce inactivity screen locks on endpoints that can reach the interface.
What's affected
Per the Palo Alto Networks advisory, these PAN-OS versions are affected:
- 11.0: earlier than 11.0.2
- 10.2: earlier than 10.2.5
- 10.1: earlier than 10.1.10-h1 and earlier than 10.1.11
- 10.0: earlier than 10.0.12-h1 and earlier than 10.0.13
- 9.1: earlier than 9.1.17
- 9.0: earlier than 9.0.17-h2
PAN-OS 11.1, Cloud NGFW and Prisma Access are not affected. Fixed versions are 9.0.17-h2, 9.1.17, 10.0.12-h1, 10.1.10-h1, 10.2.5, 11.0.2 and all later releases.
Two sources give two scores, and both say Medium. The NVD record shows CVSS 6.6 (version 3.1, with a physical attack vector). The vendor advisory shows CVSS-B 5.4 (version 4.0) and a suggested urgency of reduced. Palo Alto Networks says it is not aware of malicious exploitation, and the record's KEV flag is false.
How to check if you're exposed
Log in to the CLI of each firewall or Panorama-managed device and run:
show system info
Read the sw-version line and compare it with the affected list above. Panorama also shows software versions for managed devices in its device inventory.
Then ask a second question: who can reach the management web interface, and from which machines? The advisory's workaround is about those endpoints, so list them.
What to do now
- Inventory PAN-OS versions across firewalls and Panorama.
- Plan upgrades to a fixed release on your branch, or to the latest release your change process allows.
- Enforce inactivity screen locks on every endpoint that can open the PAN-OS web interface, as the advisory recommends.
- Restrict management interface access to a small admin network.
- Re-check versions after the upgrade window.
Why it matters
The record maps this to CWE-613 (CWE-613), insufficient session expiration. A session that outlives its useful life stays valid for whoever holds the token or the unlocked machine. In this case the CVSS version 3.1 vector uses a physical attack vector and requires user interaction, which fits the advisory's focus on unattended endpoints.
The practical risk is low compared with remote flaws, which is why the vendor rates urgency as reduced. It is still a firewall management plane, so an unlocked admin laptop with a live session is worth closing off. Patch on your normal cycle and fix the screen lock policy now.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which workaround does the vendor give?
Ensure that inactivity based screen locks are enforced on endpoints with access to the PAN-OS web interface. It is a mitigation, not a fix.
Why do the record and the advisory show different scores?
They use different CVSS versions. The NVD record shows 6.6 under version 3.1, and the advisory shows 5.4 under version 4.0. Both are Medium.
Sources
Last reviewed: 19 October 2026.
