PAN-OS: Improper Neutralization of Input in the Management Web Interface

Description

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

Scores

EPSS (exploitation in 30 days)

0.42% · top 64% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Weakness

• CWE-83: Improper Neutralization of Script in Attributes in a Web Page (opens in a new tab)All about CWE-83 and its CVEs

Affected products

• Palo Alto Networks · Cloud NGFW

  • unaffected All – < 6.3.3

• Palo Alto Networks · PAN-OS

  • affected 11.2.0 – < 11.2.5
  • affected 11.1.0 – < 11.1.8
  • affected 10.2.0 – < 10.2.13
  • affected 10.1.0 – < 10.1.14-h14

What to do

Solution: Version Minor Version Suggested Solution PAN-OS 11.2 11.2.0 through 11.2.4Upgrade to 11.2.5 or later PAN-OS 11.111.1.0 through 11.1.7 Upgrade to 11.1.8 or laterPAN-OS 10.2 10.2.0 through 10.2.12Upgrade to 10.2.13 or laterPAN-OS 10.1 10.1.0 through 10.1.14 Upgrade to 10.1.14-h14 or later All other unsupported PAN-OS versions Upgrade to a supported fixed version.

Workaround: Recommended mitigation—The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 * Palo Alto Networks official and detailed technical documentation:  https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices

Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.

References (1)

• https://security.paloaltonetworks.com/CVE-2025-0137 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-0137](https://trackcve.app/badge/CVE-2025-0137.svg)](https://trackcve.app/cve/CVE-2025-0137)

Record last updated 14 May 2025, 20:49 UTC.