{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T21:29:54.052Z",
  "tag": {
    "id": "firewall",
    "label": "Firewall",
    "isStack": false,
    "url": "https://pwn.watch/t/firewall",
    "feed": "https://pwn.watch/t/firewall/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "zyxel-multiple-firewalls-cve-2024-11667",
      "title": "Zyxel Multiple Firewalls Path Traversal",
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667",
      "json": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Zyxel Multiple Firewalls",
      "tags": [
        "zyxel",
        "firewall",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-11667"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-27",
      "closedAt": "2024-12-03",
      "updatedAt": "2024-12-03",
      "summary": "Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. Added to the CISA KEV catalog on 2024-12-03. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474",
      "title": "Palo Alto PAN-OS management interface auth bypass + privilege escalation",
      "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474",
      "json": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Palo Alto Networks PAN-OS",
      "tags": [
        "palo-alto",
        "pan-os",
        "zero-day",
        "auth-bypass",
        "firewall",
        "cisa-kev",
        "ransomware",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-0012",
        "CVE-2024-9474"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-18",
      "closedAt": "2024-11-18",
      "updatedAt": "2024-11-18",
      "summary": "CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "title": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "json": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisco-ftd",
        "zero-day",
        "espionage",
        "firewall",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20353",
        "CVE-2024-20359"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-04-24",
      "closedAt": "2024-04-24",
      "updatedAt": "2024-04-24",
      "summary": "Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.",
      "xPost": null
    },
    {
      "slug": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400",
      "title": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)",
      "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400",
      "json": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Palo Alto Networks PAN-OS",
      "tags": [
        "palo-alto",
        "pan-os",
        "zero-day",
        "rce",
        "vpn",
        "firewall",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-3400"
      ],
      "affectedVersions": [
        "PAN-OS 10.2, 11.0 and 11.1 with GlobalProtect (exact hotfix ranges in the Palo Alto advisory)"
      ],
      "fixedVersions": [
        "Hotfix releases per the Palo Alto advisory, e.g. 10.2.9-h1, 11.0.4-h1, 11.1.2-h3"
      ],
      "startedAt": "2024-04-12",
      "closedAt": "2024-04-12",
      "updatedAt": "2024-04-12",
      "summary": "A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "zyxel-multiple-firewalls-cve-2024-11667",
      "incidentTitle": "Zyxel Multiple Firewalls Path Traversal",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-03",
      "title": "CISA added CVE-2024-11667 to the KEV catalog (federal deadline 2024-12-24)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667"
    },
    {
      "incident": "zyxel-multiple-firewalls-cve-2024-11667",
      "incidentTitle": "Zyxel Multiple Firewalls Path Traversal",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-27",
      "title": "CVE-2024-11667 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-11667",
      "url": "https://pwn.watch/i/zyxel-multiple-firewalls-cve-2024-11667"
    },
    {
      "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474",
      "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-18",
      "title": "CVE-2024-0012 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-0012",
      "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474"
    },
    {
      "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474",
      "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-18",
      "title": "CVE-2024-9474 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474",
      "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474"
    },
    {
      "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474",
      "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-18",
      "title": "CISA added CVE-2024-0012 to the KEV catalog (federal deadline 2024-12-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474"
    },
    {
      "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474",
      "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-18",
      "title": "CISA added CVE-2024-9474 to the KEV catalog (federal deadline 2024-12-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CVE-2024-20353 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20353",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CVE-2024-20359 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20359",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CISA added CVE-2024-20353 to the KEV catalog (federal deadline 2024-05-01)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CISA added CVE-2024-20359 to the KEV catalog (federal deadline 2024-05-01)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "Cisco Talos discloses the ArcaneDoor campaign; Cisco ships fixes",
      "body": null,
      "sourceUrl": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400",
      "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-12",
      "title": "CVE-2024-3400 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400",
      "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400"
    },
    {
      "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400",
      "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-12",
      "title": "CISA added CVE-2024-3400 to the KEV catalog (federal deadline 2024-04-19)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400"
    },
    {
      "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400",
      "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-12",
      "title": "Palo Alto publishes the advisory; Volexity and Unit 42 publish exploitation details",
      "body": null,
      "sourceUrl": "https://security.paloaltonetworks.com/CVE-2024-3400",
      "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400"
    }
  ]
}