CVE-2024-3400: GlobalProtect - OS Command Injection
HoneyLabs honeypots recorded 1 probe matching CVE-2024-3400 from 1 distinct source IP address in the last 7 days. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2024-04-12.
What the sensors show
All of them arrived on one day, 2026-10-31. It is still being probed 2 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 50 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i100900_61a7ad8aa9b6_1e1ff825b6a9.
Request paths that identify it
- /global-protect/portal/images/{{*}}.txt
- /ssl-vpn/hipreport.esp
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 87.192.41.180 | 1 | Fontaine, LLC | The Netherlands |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS218751 | Fontaine, LLC | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| The Netherlands | 1 |
Captured requests
- /ssl-vpn/hipreport.esp
HTTP client fingerprints
- b11cuq060_08050811_ffe60107
CVE report
Open a specific CVE from the CVE tracker.