nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-0125 CVE-2025-0125
MEDIUM
PAN-OS: Improper Neutralization of Input in the Management Web Interface
Record summary
CVE-2025-0125 has a selected CVSS score of 6.9 (medium).
Description
An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW and all Prisma® Access instances.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 11, 2025 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
Cloud NGFWBrowse Palo Alto Networks / Cloud NGFWDefault status: unaffected | CVE List | All versions | unaffected |
Default status: unaffected | CVE List | 11.2.0 to < 11.2.5 | affected |
| 11.1.0 to < 11.1.5 | affected | ||
| 11.0.0 to < 11.0.6 | affected | ||
| 10.2.0 to < 10.2.11 | affected | ||
| 10.1.0 to < 10.1.14-h11 | affected | ||
Prisma AccessBrowse Palo Alto Networks / Prisma AccessDefault status: unaffected | CVE List | All versions | unaffected |
References
2security.paloaltonetworks.comVendor advisory
https://security.paloaltonetworks.com/CVE-2025-0125