Skip to content
OpenAdvisories
High WID-SEC-2025-0780 6 CVEs

PaloAlto Networks PAN-OS: Mehrere Schwachstellen

Published Apr 9, 2025 · Updated Apr 9, 2025 · de-DE

Vendor: Palo Alto Networks Product: PAN-OS

Summary

Ein Angreifer kann mehrere Schwachstellen in PaloAlto Networks PAN-OS ausnutzen, um Informationen preiszugeben, erhöhte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.

Product

PAN-OS ist das Betriebssystem der Sicherheitssysteme / Firewalls der Firma Palo Alto Networks.

Vulnerabilities 6

  • High 8.3
    CVE-2025-0126

    PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

    When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a mali…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • High 7.1
    CVE-2025-0127

    PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series

    A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not aff…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 5.8
    CVE-2025-0125

    PAN-OS: Improper Neutralization of Input in the Management Web Interface

    An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The atta…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 5.3
    CVE-2025-0128

    PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet

    A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repea…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Low 2.1
    CVE-2025-0124

    PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

    An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configur…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • None 0.0
    CVE-2025-0123

    PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures

    A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-packet-captures/take-a-cu…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices

Revision history

  1. #1

    Initiale Fassung

References