[Palo Alto Networks Security Advisories] CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management WebInterface
Palo Alto Networks Security Advisories /CVE-2025-4615
CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface
Description
An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands.
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.
Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 12.1 | None | All |
| PAN-OS 11.2 | < 11.2.8 | >= 11.2.8 |
| PAN-OS 11.1 | < 11.1.11 | >= 11.1.11 |
| PAN-OS 10.2 | < 10.2.17 | >= 10.2.17 |
| Prisma Access | None | All |
Severity:MEDIUM, Suggested Urgency:MODERATE
You can greatly reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface. This will ensure that attacks can succeed only if they obtain privileged access through those specified IP addresses. We recommend remediating this vulnerability in your next scheduled maintenance cycle.
MEDIUM– CVSS-BT: 4.5 /CVSS-B: 6.9 (CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
The risk is highest when you allow access to the management interface from external IP addresses on the internet. Our recommendation is to remediate as soon as possible.
MEDIUM– CVSS-BT: 4.8 /CVSS-B: 7.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
CWE-83 Improper Neutralization of Script in Attributes in a Web Page
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cloud NGFW | No action needed. | |
| PAN-OS 12.1 | No action needed. | |
| PAN-OS 11.2 | 11.2.0 through 11.2.7 | Upgrade to 11.2.8 or later. |
| PAN-OS 11.1 | 11.1.0 through 11.1.10 | Upgrade to 11.1.11 or later. |
| PAN-OS 10.2 | 10.2.0 through 10.2.16 | Upgrade to 10.2.17 or later. |
| Prisma Access | No action needed. |
Workarounds and Mitigations
No known workarounds exist for this issue.
Acknowledgments
CPE Applicability
- cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.0 and up to (excluding)11.2.8
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.0 and up to (excluding)11.1.11
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.0 and up to (excluding)10.2.17
Timeline
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
