This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Palo Alto Networks fixes 5 vulnerabilities

Palo Alto Networks fixes 5 vulnerabilities in its products. The most severe ones are described below [1][2][3][4]; the rest can be found at [5]. Products and their fixed versions: PAN-OS [1][3][4] - 10.1.14-h11; - 10.2.13-h5, 10.2.14 (expected availability 3.4.2025); - 11.0.6; - 11.1.8; - 11.2.5; GlobalProtect App (for Windows) [2][5] - 6.2.6; - 6.3.3 (expected availability in April 2025).

Palo Alto Networks PAN-OS - DoS (CVE-2025-0114)
CVSS 4.6 (Medium)

An unauthenticated remote attacker can carry out a DoS attack on the GlobalProtect service in PAN-OS. Only instances with this functionality are vulnerable. The configuration can be verified in the firewall web interface under Network > GlobalProtect > Portals and Network > GlobalProtect > Gateways [1].

The vulnerability is present in product:

  • *:Palo Alto Networks PAN-OS;>=10.1,<10.1.14-h11;>=10.2,<10.2.5;>=11.0,<11.0.2;

CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 12. 3. 2025.

Palo Alto Networks GlobalProtect App - privilege escalation (CVE-2025-0117)
CVSS 4.3 (Medium)

An authenticated local attacker without administrator privileges can escalate their privileges to NT AUTHORITY\SYSTEM in GlobalProtect App on Windows. In addition to updating to the fixed version, it is necessary to modify a Windows registry key by adding the value "check-communication"="yes" as REG_SZ at the location: [HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings] and restart the device. For new installations, the command msiexec.exe /i GlobalProtect64.msi CHECKCOMM="yes" can alternatively be used, which sets the correct value automatically. Without this configuration, the device remains vulnerable even after the update [2].

The vulnerability is present in product:

  • Windows:Palo Alto Networks GlobalProtect App;>=6.0,<6.2.6;>=6.3,<6.3.3;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 12. 3. 2025.

Palo Alto Networks PAN-OS - arbitrary file read (CVE-2025-0115)
CVSS 4.3 (Medium)

An authenticated local attacker with administrator privileges can read arbitrary files in the PAN-OS CLI [3]. The risk of attack can be significantly reduced by restricting access to the management interface to trusted internal IP addresses only, as recommended at [6].

The vulnerability is present in product:

  • *:Palo Alto Networks PAN-OS;>=10.1,<10.1.14-h11;>=10.2,<10.2.11;>=11.0,<11.0.6;>=11.1,<11.1.5;>=11.2,<11.2.3;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 12. 3. 2025.

Palo Alto Networks PAN-OS - DoS (CVE-2025-0116)
CVSS 4.3 (Medium)

An unauthenticated remote attacker can carry out a DoS attack on the firewall in PAN-OS by sending specially crafted LLDP frames. Only systems with LLDP frames enabled on at least one network interface are vulnerable. More detailed information is available at [4].

The vulnerability is present in product:

  • *:Palo Alto Networks PAN-OS>=10.1,<10.1.14-h11;>=10.2,<10.2.13-h5;>10.2.13-h5,<10.2.14;>=11.1,<11.1.8;>=11.2,<11.2.5;

CVSS: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 12. 3. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 17. 3. 2025.

CESNET, z.s.p.o. Logo