{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2025-0128", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2024-12-20T23:23:28.952Z", "datePublished": "2025-04-11T02:03:22.355Z", "dateUpdated": "2025-04-11T16:01:46.600Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "platforms": [ "PAN-OS" ], "product": "Cloud NGFW", "vendor": "Palo Alto Networks", "versions": [ { "status": "unaffected", "version": "All", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h32:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h31:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h30:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h29:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h28:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h27:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h26:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h25:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h24:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h23:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h22:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h21:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h20:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h19:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h18:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h17:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h16:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h15:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h14:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h13:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h12:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h11:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h10:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h10:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h9:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h7:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h5:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h3:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h1:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.13:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.12:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.7:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.5:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.3:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:paloaltonetworks:pan-os:10.1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "PAN-OS", "vendor": "Palo Alto Networks", "versions": [ { "changes": [ { "at": "11.2.3", "status": "unaffected" } ], "lessThan": "11.2.3", "status": "affected", "version": "11.2.0", "versionType": "custom" }, { "changes": [ { "at": "11.1.5", "status": "unaffected" } ], "lessThan": "11.1.5", "status": "affected", "version": "11.1.0", "versionType": "custom" }, { "changes": [ { "at": "11.0.6", "status": "unaffected" } ], "lessThan": "11.0.6", "status": "affected", "version": "11.0.0", "versionType": "custom" }, { "changes": [ { "at": "10.2.10-h17", "status": "unaffected" } ], "lessThan": "10.2.10-h17", "status": "affected", "version": "10.2.0", "versionType": "custom" }, { "changes": [ { "at": "10.1.14-h11", "status": "unaffected" } ], "lessThan": "10.1.14-h11", "status": "affected", "version": "10.1.0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "platforms": [ "PAN-OS" ], "product": "Prisma Access", "vendor": "Palo Alto Networks", "versions": [ { "changes": [ { "at": "10.2.10-h17", "status": "unaffected" }, { "at": "10.2.4-h36", "status": "unaffected" } ], "lessThan": "10.2.4-h36", "status": "affected", "version": "10.2.0", "versionType": "custom" }, { "lessThan": "11.2.4-h5", "status": "affected", "version": "11.2.0", "versionType": "custom" } ] } ], "configurations": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "NOTE: You do not need to have explicitly configured SCEP on your firewall to be at risk. Firewalls for which you do not apply the explicit mitigation for this issue are affected." } ], "value": "NOTE: You do not need to have explicitly configured SCEP on your firewall to be at risk. Firewalls for which you do not apply the explicit mitigation for this issue are affected." } ], "credits": [ { "lang": "en", "type": "finder", "value": "Abyss Watcher" } ], "datePublic": "2025-04-09T16:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.

Cloud NGFW is not affected by this vulnerability. Prisma® Access software is proactively patched and protected from this issue.

" } ], "value": "A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.\n\nCloud NGFW is not affected by this vulnerability. Prisma® Access software is proactively patched and protected from this issue." } ], "exploits": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue." } ], "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue." } ], "impacts": [ { "capecId": "CAPEC-153", "descriptions": [ { "lang": "en", "value": "CAPEC-153 Input Data Manipulation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "A user sends a malicious crafted packet through the firewall, which processes a malicious packet that causes this issue." } ] }, { "cvssV4_0": { "Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/R:U/V:C/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "For Prisma Access, this issue can only be initiated by authenticated end users that use a maliciously crafted packet." } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2025-04-11T02:03:22.355Z" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://security.paloaltonetworks.com/CVE-2025-0128" } ], "solutions": [ { "lang": "eng", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
Version
Minor Version
Suggested Solution
PAN-OS 11.2
11.2.0 through 11.2.2Upgrade to 11.2.3 or later
PAN-OS 11.111.1.0 through 11.1.4
Upgrade to 11.1.5 or later
PAN-OS 11.0
11.0.0 through 11.0.5
Upgrade to 11.0.6 or later
PAN-OS 10.2
10.2.0 through 10.2.10Upgrade to 10.2.11 or later
PAN-OS 10.1
10.1.0 through 10.1.14
Upgrade to 10.1.14-h11 or later
All other older
unsupported
PAN-OS versions		 Upgrade to a supported fixed version.

PAN-OS 11.0 is EoL. We listed it in this section for completeness because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 in any of your firewalls, we strongly recommend that you upgrade to a fixed supported version.

We proactively initiated the upgrade through Prisma Access March 21, 2025, to cover all tenants." } ], "value": "Version\nMinor Version\nSuggested Solution\nPAN-OS 11.2\n11.2.0 through 11.2.2Upgrade to 11.2.3 or later\nPAN-OS 11.111.1.0 through 11.1.4\nUpgrade to 11.1.5 or laterPAN-OS 11.0\n11.0.0 through 11.0.5\nUpgrade to 11.0.6 or later\nPAN-OS 10.2\n10.2.0 through 10.2.10Upgrade to 10.2.11 or laterPAN-OS 10.1\n10.1.0 through 10.1.14\nUpgrade to 10.1.14-h11 or later\nAll other older\nunsupported\nPAN-OS versions Upgrade to a supported fixed version.\nPAN-OS 11.0 is EoL. We listed it in this section for completeness because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 in any of your firewalls, we strongly recommend that you upgrade to a fixed supported version.\n\nWe proactively initiated the upgrade through Prisma Access March 21, 2025, to cover all tenants." } ], "source": { "defect": [ "PAN-255859" ], "discovery": "EXTERNAL" }, "timeline": [ { "lang": "en", "time": "2025-04-09T16:00:00.000Z", "value": "Initial Publication" } ], "title": "PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "If you are not using SCEP, you can disable it to mitigate this risk by running the following command in your PAN-OS command-line interface (CLI):

> debug sslmgr set disable-scep-auth-cookie yes

CAUTION: This workaround is effective only until the next reboot, after which you must rerun this command to stay protected." } ], "value": "If you are not using SCEP, you can disable it to mitigate this risk by running the following command in your PAN-OS command-line interface (CLI):\n> debug sslmgr set disable-scep-auth-cookie yes\n\nCAUTION: This workaround is effective only until the next reboot, after which you must rerun this command to stay protected." } ], "x_generator": { "engine": "Vulnogram 0.1.0-dev" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2025-04-11T15:10:28.623543Z", "id": "CVE-2025-0128", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T16:01:46.600Z" } } ] } }