CVE report
CVE-2024-0012criticalKEV
PAN-OS Management Web Interface - Authentication Bypass
Events 90d
56
Distinct IPs
56
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2024-0012 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /php/ztp_gate.php/.js.map
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 11 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2024-0012
- 66.228.53.1051 eventsUnited States
- 45.79.207.141 eventsUnited States
- 157.230.180.2261 eventsUnited States
- 50.116.30.1891 eventsUnited States
- 194.195.211.1991 eventsUnited States
- 170.64.233.1631 eventsAustralia
- 159.89.55.591 eventsUnited States
- 74.207.243.861 eventsUnited States
- 165.22.150.1721 eventsUnited States
- 159.65.226.1561 eventsUnited States
- 97.107.135.2501 eventsUnited States
- 147.182.179.261 eventsUnited States
- 167.99.151.1641 eventsUnited States
- 167.71.156.631 eventsUnited States
- 134.122.36.2551 eventsCanada
- 139.177.205.431 eventsUnited States
- 170.64.146.1801 eventsAustralia
- 173.255.221.61 eventsUnited States
- 165.227.23.21 eventsUnited States
- 192.81.131.1401 eventsUnited States
- 165.227.21.391 eventsUnited States
- 74.207.252.1091 eventsUnited States
- 66.228.47.401 eventsUnited States
- 45.79.103.441 eventsUnited States
- 178.128.179.481 eventsUnited States
- 134.209.54.581 eventsUnited States
- 134.209.56.51 eventsUnited States
- 66.228.47.921 eventsUnited States
- 74.207.254.1271 eventsUnited States
- 23.239.12.2141 eventsUnited States
Top networks the attempts come from
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
Sample request paths observed
- /php/ztp_gate.php/.js.map