CVE-2025-0130

HIGH

Palo Alto Networks PAN-OS 11.1.0-11.1.5 and 11.2.0-11.2.4 - Unauthenticated Denial of Service via Malformed Packet Burst

Title source: llm

Description

A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this condition will cause the firewall to enter maintenance mode. This issue does not affect Cloud NGFW or Prisma Access.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://security.paloaltonetworks.com/CVE-2025-0130

Scores

CVSS v3 7.5

EPSS 0.0034

EPSS Percentile 25.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-754

Status published

Products (9)

Palo Alto Networks/Cloud NGFW All

Palo Alto Networks/PAN-OS 10.1.0

Palo Alto Networks/PAN-OS 10.2.0

Palo Alto Networks/PAN-OS 11.1.0 - 11.1.6-h1

Palo Alto Networks/PAN-OS 11.2.0 - 11.2.5

Palo Alto Networks/Prisma Access All

paloaltonetworks/pan-os 11.1.7 (2 CPE variants)

paloaltonetworks/pan-os 11.1.0 - 11.1.6

paloaltonetworks/pan-os 11.2.0 - 11.2.5

Published May 14, 2025

Tracked Since Feb 18, 2026