CVE-2021-3048

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall remains otherwise functional. If the firewall then restarts, it results in a denial-of-service (DoS) condition and the firewall stops processing traffic. This issue impacts: PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. PAN-OS 8.1 and PAN-OS 10.1 versions are not impacted.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-304808.8Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user inter CVE-2021-304819.0Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because o CVE-2021-304827.5In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly CVE-2021-304835.3isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.CVE-2021-304856.5An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrec CVE-2021-304868.8SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (P CVE-2021-304872.7In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizat CVE-2021-30494.3An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with i CVE-2021-304907.8upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Aut CVE-2021-304935.5Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBr CVE-2021-304945.5Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Ch CVE-2021-304965.7The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an at