CVE-2020-2038

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	>= 10.0, < 10.0.1; >= 9.0, < 9.0.10; >= 9.1, < 9.1.4

References

http://packetstormsecurity.com/files/168008/PAN-OS-10.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/168408/Palo-Alto-Networks-Authenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://security.paloaltonetworks.com/CVE-2020-2038Vendor Advisory
http://packetstormsecurity.com/files/168008/PAN-OS-10.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/168408/Palo-Alto-Networks-Authenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://security.paloaltonetworks.com/CVE-2020-2038Vendor Advisory

Timeline

Published: Sep 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-203894.8Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php.CVE-2020-20395.3An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary CVE-2020-203915.4Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets.CVE-2020-203929.8SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.CVE-2020-20409.8A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary c CVE-2020-204027.5Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation.CVE-2020-204065.4A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions CVE-2020-20417.5An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically CVE-2020-204126.5lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a craft CVE-2020-204139.8SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in ad CVE-2020-20427.2A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and p CVE-2020-204256.1S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.