PAN-OS: Improper Neutralization of Input in the Management Web Interface

Description

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW and all Prisma® Access instances.

Scores

EPSS (exploitation in 30 days)

0.43% · top 62% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

• CWE-83: Improper Neutralization of Script in Attributes in a Web Page (opens in a new tab)All about CWE-83 and its CVEs

Affected products

• Palo Alto Networks · Cloud NGFW

  • unaffected All

• Palo Alto Networks · PAN-OS

  • affected 11.2.0 – < 11.2.5
  • affected 11.1.0 – < 11.1.5
  • affected 11.0.0 – < 11.0.6
  • affected 10.2.0 – < 10.2.11
  • affected 10.1.0 – < 10.1.14-h11

• Palo Alto Networks · Prisma Access

  • unaffected All

What to do

Solution: Version Minor Version Suggested Solution PAN-OS 11.2 11.2.0 through 11.2.2Upgrade to 11.2.3 or later PAN-OS 11.111.1.0 through 11.1.4 Upgrade to 11.1.5 or laterPAN-OS 11.0 11.0.0 through 11.0.5 Upgrade to 11.0.6 or later PAN-OS 10.2 10.2.0 through 10.2.10Upgrade to 10.2.11 or laterPAN-OS 10.1 10.1.0 through 10.1.14 Upgrade to 10.1.14-h11 or later All other older unsupported PAN-OS versions Upgrade to a supported fixed version. PAN-OS 11.0 is EoL. We listed it in this section for completeness because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 in any of your firewalls, we strongly recommend that you upgrade to a fixed supported version.

Workaround: Recommended mitigation—The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Specifically, you should restrict management interface access to only trusted internal IP addresses. Review information about how to secure management access to your Palo Alto Networks firewalls: * Palo Alto Networks LIVEcommunity article:  https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 * Palo Alto Networks official and detailed technical documentation:  https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices

Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.

References (1)

• https://security.paloaltonetworks.com/CVE-2025-0125 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-0125](https://trackcve.app/badge/CVE-2025-0125.svg)](https://trackcve.app/cve/CVE-2025-0125)

Record last updated 11 Apr 2025, 16:02 UTC.