Skip to content
OpenAdvisories
Medium WID-SEC-2025-1064 4 CVEs

PaloAlto Networks PAN-OS: Mehrere Schwachstellen

Published May 14, 2025 · Updated May 14, 2025 · de-DE

Vendor: Palo Alto Networks Product: PAN-OS

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PaloAlto Networks PAN-OS ausnutzen, um einen Denial of Service Angriff durchzuführen, Cross-Site-Scripting durchzuführen, Informationen auszuspähen oder Sicherheitsmaßnahmen zu umgehen.

Product

PAN-OS ist das Betriebssystem der Sicherheitssysteme / Firewalls der Firma Palo Alto Networks.

Vulnerabilities 4

  • High 8.2
    CVE-2025-0130

    PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets

    A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeat…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 5.3
    CVE-2025-0136

    PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices

    Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall throug…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Low 2.7
    CVE-2025-0133 Public exploit Scanner template EPSS 46%

    PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal

    A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they …

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Low 2.0
    CVE-2025-0137

    PAN-OS: Improper Neutralization of Input in the Management Web Interface

    An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The atta…

    Palo Alto Networks PAN-OS Cloud NGFW Network devices

Revision history

  1. #1

    Initiale Fassung

References