Unsecured Data Transfer in Palo Alto Networks PAN-OS Firewalls
CVE-2025-0136

5.3MEDIUM

Key Information:

Vendor

Palo Alto Networks
Status
Cloud Ngfw
Pan-os
Prisma Access
Vendor
CVE Published:
14 May 2025

Badges

👾 Exploit Exists

What is CVE-2025-0136?

Certain models of Palo Alto Networks PAN-OS® firewalls utilize the AES-128-CCM encryption algorithm for IPSec connections, which can lead to the risk of unencrypted data transfers to connected devices. This vulnerability can compromise the confidentiality of sensitive data. It is important to note that this issue does not affect Cloud NGFWs, Prisma® Access instances, or PAN-OS VM-Series firewalls, highlighting specific vulnerabilities in the hardware-centric models. The use of the AES-128-CCM algorithm is not recommended due to inherent security weaknesses, and organizations are encouraged to assess their configurations urgently.

Affected Version(s)

PAN-OS 11.1.0 < 11.1.5

PAN-OS 11.0.0 < 11.0.7

PAN-OS 10.2.0 < 10.2.11

References

https://security.paloaltonetworks.com/CVE-2025-0136
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Benjamin Bai of Palo Alto Networks
.
CVE-2025-0136 : Unsecured Data Transfer in Palo Alto Networks PAN-OS Firewalls