Palo Alto Networks this week patched four serious vulnerabilities affecting PAN-OS equipped firewalls. The vulnerabilities were discovered by researchers Mikhail Klyuchnikov and Nikita Abramov of Positive Technologies.

The security vulnerabilities could have allowed attackers to obtain sensitive data or access portions of an enterprise's corporate network.

The first of these vulnerabilities, which was ranked a 7.2 in severity, would have allowed an attacker to execute arbitrary operating system commands in the Palo Alto Networks firewall, enabling them to place malicious code in a webform.

"We performed black-box testing of the [next-generation firewall] management web interface to detect this vulnerability, which results from the lack of user input sanitization," said Klyuchnikov in a statement. "During a real attack, hackers can, for example, brute force the password for the administration, perform [remote code execution], and gain access to the Palo Alto product, as well as the company's internal network."

Klyuchnikov noted that because the admin panel can be located both inside and outside the corporate network, it is possible for attacks to take place internally and externally.

The second security vulnerability, which was scored an 8.8 in severity, is similar to the first, but leverages cross-site scripting to embed a malicious link into the Palo Alto Networks firewall's admin panel. Once clicked by an unsuspecting victim, the attacker would then be able to execute commands as that user.

Positive Technologies noted this vulnerability can be conducted over the internet with the caveat that if the admin panel is located on the internal network, the attacker would need to know its address within the network.

The third vulnerability, which also ranked a 7.2 in severity, allowed attackers to execute commands normally limited in the software interface.

"By default, when working with this interface, there are restrictions on the system command call. The exception is some basic commands, such as ping," a statement from Positive Technologies read. However, researchers noted that it is possible to inject any command using "insufficient filtering of user data."'

The final vulnerability received the lowest severity score of 5.3, and could allow an unauthorized user to upload arbitrary files of any size to a certain directory on the server. Researchers noted that this could be exploited as part of a denial of service (DDoS) attack.

Users of Palo Alto firewalls running PAN-OS 8.1 or later are advised to update their equipment to the most recent version to mitigate the risk of an attack.