PAN-OS: Threat signatures are evaded by specifically crafted packets

Description

A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0.

Scores

EPSS (exploitation in 30 days)

1.3% · top 29% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-754 Improper Check for Unusual or Exceptional Conditions (opens in a new tab)All about CWE-754 and its CVEs

Affected products

• Palo Alto Networks · PAN-OS

  • affected 7.1.*
  • affected 8.0.*
  • unaffected 10.0.*
  • affected 8.1 – < 8.1.17
  • affected 9.0 – < 9.0.11
  • affected 9.1 – < 9.1.5

What to do

Solution: This issue is fixed in PAN-OS 8.1.17, PAN-OS 9.0.11, PAN-OS 9.1.5, and all later PAN-OS versions.

Workaround: There are no known workarounds for this issue.

Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.

References (1)

• https://security.paloaltonetworks.com/CVE-2020-1999 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-1999](https://trackcve.app/badge/CVE-2020-1999.svg)](https://trackcve.app/cve/CVE-2020-1999)

Record last updated 17 Sept 2024, 01:15 UTC.