CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
74.3%
BGP software such as FRRouting FRR included as part of the PAN-OS, Prisma SD-WAN ION, and Prisma Access routing features enable a remote attacker to incorrectly reset network sessions though an invalid BGP update. This issue is applicable only to devices and appliances with BGP routing features enabled.
This issue requires the remote attacker to control at least one established BGP session that is propagated to the router to exploit it. The denial-of-service (DoS) impact on the network is dependent on the network’s architecture and fault tolerant design.
Prisma Access ‘Security Processing Node Endpoint Remote Network (SP-RN/Branches)’ and ‘Service Connections (SCs/CANs)’ nodes do not peer with the Internet and do not receive Internet routes directly unless explicitly configured by the customer. Prisma Access Nodes are commonly protected by unaffected customer-premise equipment (CPE router devices). Hence the impact of this issue on Prisma Access is limited.
Further details about this issue can be found at: https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling
Work around:
You can prevent exploitation of this issue by inserting an unaffected BGP router—configured to drop the invalid BGP update instead of propagating it—between the attacker-originated BGP update and PAN-OS, Prisma SD-WAN ION, and Prisma Access devices. This stops the invalid BGP update from reaching the affected router.
Vendor | Product | Version | CPE |
---|---|---|---|
software | pan-os | * | cpe:2.3:a:software:pan-os:*:*:*:*:*:*:*:* |
software | prisma_access | * | cpe:2.3:a:software:prisma_access:*:*:*:*:*:*:*:* |
software | prisma_sd-wan_ion | * | cpe:2.3:a:software:prisma_sd-wan_ion:*:*:*:*:*:*:*:* |