PAN-OS XML Processing Buffer Overflow Leading to Root RCE (PA-Series) or DoS (VM-Series)

#!/usr/bin/env bash
# check_cve_2026_0310.sh — Check PAN-OS version for CVE-2026-0310
# Usage: bash check_cve_2026_0310.sh <firewall-ip> <admin-user>
# Requires: SSH access to PAN-OS CLI
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 2 ]; then
  echo "Usage: $0 <firewall-ip> <admin-user>"
  exit 2
fi

FW_IP="$1"
FW_USER="$2"

# Grab PAN-OS version via CLI
VERSION=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${FW_USER}@${FW_IP}" 'show system info' 2>/dev/null | grep 'sw-version:' | awk '{print $2}' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not retrieve PAN-OS version from ${FW_IP}"
  exit 2
fi

echo "Detected PAN-OS version: ${VERSION}"

# Version comparison helper
version_gte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# Check against fixed versions per major branch
case "$VERSION" in
  12.2*)
    if version_gte "$VERSION" "12.2.3"; then
      echo "PATCHED — ${VERSION} >= 12.2.3"
      exit 0
    else
      echo "VULNERABLE — ${VERSION} < 12.2.3 (CVE-2026-0310)"
      exit 1
    fi
    ;;
  12.1*)
    if version_gte "$VERSION" "12.1.10"; then
      echo "PATCHED — ${VERSION} >= 12.1.10"
      exit 0
    else
      echo "VULNERABLE — ${VERSION} < 12.1.10 (CVE-2026-0310). Check if hotfix 12.1.7-h5 or 12.1.4-h10 applies."
      exit 1
    fi
    ;;
  11.2*)
    if version_gte "$VERSION" "11.2.13-h2"; then
      echo "PATCHED — ${VERSION} >= 11.2.13-h2"
      exit 0
    else
      echo "VULNERABLE — ${VERSION} < 11.2.13-h2 (CVE-2026-0310). Check hotfix branches 11.2.10-h14 or 11.2.7-h20."
      exit 1
    fi
    ;;
  11.1*)
    echo "VULNERABLE — PAN-OS 11.1.x requires specific hotfixes for CVE-2026-0310. Consult advisory SVD-2026-0310."
    exit 1
    ;;
  10.2*)
    echo "VULNERABLE — PAN-OS 10.2.x requires specific hotfixes for CVE-2026-0310. Consult advisory SVD-2026-0310."
    exit 1
    ;;
  *)
    echo "UNKNOWN — PAN-OS ${VERSION} not in affected range (10.2–12.2) or unrecognized version format."
    exit 2
    ;;
esac