Yih Khai Wong, senior research manager for security services at IDC Asia/Pacific, said security teams should trace who can reach the management interface from outside a trusted network and review admin login history for unusual activity. “They should also check firewall configurations for unexpected changes, since a compromised device can be quietly reconfigured to remain compromised,” he said.
“Patching is only part of the response,” said Vibhum Dubey, a cybersecurity researcher and red teamer. He said teams should check Panorama and every managed firewall and preserve evidence before making changes.
Affected products and fixes
The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama, in both virtual and M-Series form, according to the advisory. Cloud NGFW and Prisma Access are not affected.
