427 lines
20 KiB
JSON
427 lines
20 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2025-2182",
|
||
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "palo_alto",
|
||
"dateReserved": "2025-03-10T17:56:24.875Z",
|
||
"datePublished": "2025-08-13T17:03:21.617Z",
|
||
"dateUpdated": "2025-08-13T20:32:15.474Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "Cloud NGFW",
|
||
"vendor": "Palo Alto Networks",
|
||
"versions": [
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "3.2.449",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "3.2.449",
|
||
"status": "unaffected",
|
||
"version": "All",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"cpes": [
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:PA-7500:*",
|
||
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:PA-7500:*"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"modules": [
|
||
"Clusters"
|
||
],
|
||
"platforms": [
|
||
"PA-7500"
|
||
],
|
||
"product": "PAN-OS",
|
||
"vendor": "Palo Alto Networks",
|
||
"versions": [
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "11.2.8",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "11.2.8",
|
||
"status": "affected",
|
||
"version": "11.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "11.1.10",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "11.1.10",
|
||
"status": "affected",
|
||
"version": "11.1.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"status": "unaffected",
|
||
"version": "10.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"status": "unaffected",
|
||
"version": "10.1.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"platforms": [
|
||
"devices other than PA-7500"
|
||
],
|
||
"product": "PAN-OS",
|
||
"vendor": "Palo Alto Networks",
|
||
"versions": [
|
||
{
|
||
"status": "unaffected",
|
||
"version": "All",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "Prisma Access",
|
||
"vendor": "Palo Alto Networks",
|
||
"versions": [
|
||
{
|
||
"status": "unaffected",
|
||
"version": "All",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"configurations": [
|
||
{
|
||
"lang": "eng",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p>The following conditions must be true to be vulnerable to this issue:</p><ol><li><p>Your PA-7500 Series devices must be in an NGFW cluster. For more information regarding NGFW Clusters see our <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/ngfw-clustering/ngfw-clusters\">documentation</a>.</p></li><li><p>A MACsec policy must be configured and enabled for the NGFW cluster. For more information about MACsec profiles please see our <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-macsec-profile\">documentation</a>.</p></li></ol><b></b>"
|
||
}
|
||
],
|
||
"value": "The following conditions must be true to be vulnerable to this issue:\n\n * Your PA-7500 Series devices must be in an NGFW cluster. For more information regarding NGFW Clusters see our documentation https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/ngfw-clustering/ngfw-clusters .\n\n\n * A MACsec policy must be configured and enabled for the NGFW cluster. For more information about MACsec profiles please see our documentation https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-macsec-profile ."
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "This issue was found during an internal security review."
|
||
}
|
||
],
|
||
"datePublic": "2025-08-13T16:00:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster.<br>A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec. <br><p></p>"
|
||
}
|
||
],
|
||
"value": "A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster.\nA user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec."
|
||
}
|
||
],
|
||
"exploits": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||
}
|
||
],
|
||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-158",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-158 Sniffing Network Traffic"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"Automatable": "NO",
|
||
"Recovery": "AUTOMATIC",
|
||
"Safety": "NOT_DEFINED",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "PRESENT",
|
||
"attackVector": "PHYSICAL",
|
||
"baseScore": 5.6,
|
||
"baseSeverity": "MEDIUM",
|
||
"privilegesRequired": "HIGH",
|
||
"providerUrgency": "AMBER",
|
||
"subAvailabilityImpact": "NONE",
|
||
"subConfidentialityImpact": "HIGH",
|
||
"subIntegrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"valueDensity": "DIFFUSE",
|
||
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amber",
|
||
"version": "4.0",
|
||
"vulnAvailabilityImpact": "NONE",
|
||
"vulnConfidentialityImpact": "HIGH",
|
||
"vulnIntegrityImpact": "NONE",
|
||
"vulnerabilityResponseEffort": "MODERATE"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-312",
|
||
"description": "CWE-312 Cleartext Storage of Sensitive Information",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
|
||
"shortName": "palo_alto",
|
||
"dateUpdated": "2025-08-13T17:03:21.617Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://security.paloaltonetworks.com/CVE-2025-2182"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "eng",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<table><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>Cloud NGFW<br></td><td></td><td>No action needed.</td></tr><tr>\n <td>PAN-OS 11.2 on PA-7500<br></td>\n <td>11.2.0 through 11.2.7</td>\n <td>Upgrade to 11.2.8 or later.</td>\n </tr><tr>\n <td>PAN-OS 11.1 on PA-7500<br></td>\n <td>11.1.0 through 11.1.9</td>\n <td>Upgrade to 11.1.10 or later.</td>\n </tr><tr><td>PAN-OS 10.2 on PA-7500<br></td><td></td><td>No action needed.</td></tr><tr><td>PAN-OS 10.1 on PA-7500<br></td><td></td><td>No action needed.</td></tr><tr><td>PAN-OS on devices other than PA-7500<br></td><td></td><td>No action needed.</td></tr><tr><td>All older<br>unsupported<br>PAN-OS versions</td><td> </td><td>Upgrade to a supported fixed version.</td></tr><tr><td>Prisma Access<br></td><td></td><td>No action needed.</td></tr></tbody></table>"
|
||
}
|
||
],
|
||
"value": "Version\nMinor Version\nSuggested Solution\nCloud NGFW\nNo action needed.\n PAN-OS 11.2 on PA-7500\n\n 11.2.0 through 11.2.7\n Upgrade to 11.2.8 or later.\n \n PAN-OS 11.1 on PA-7500\n\n 11.1.0 through 11.1.9\n Upgrade to 11.1.10 or later.\n PAN-OS 10.2 on PA-7500\nNo action needed.PAN-OS 10.1 on PA-7500\nNo action needed.PAN-OS on devices other than PA-7500\nNo action needed.All older\nunsupported\nPAN-OS versions Upgrade to a supported fixed version.Prisma Access\nNo action needed."
|
||
}
|
||
],
|
||
"source": {
|
||
"defect": [
|
||
"PAN-284490"
|
||
],
|
||
"discovery": "INTERNAL"
|
||
},
|
||
"timeline": [
|
||
{
|
||
"lang": "en",
|
||
"time": "2025-08-13T16:00:00.000Z",
|
||
"value": "Initial Publication"
|
||
}
|
||
],
|
||
"title": "PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)",
|
||
"workarounds": [
|
||
{
|
||
"lang": "eng",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "No known workarounds exist for this issue."
|
||
}
|
||
],
|
||
"value": "No known workarounds exist for this issue."
|
||
}
|
||
],
|
||
"x_affectedList": [
|
||
"PAN-OS 11.2.7-h2",
|
||
"PAN-OS 11.2.7-h1",
|
||
"PAN-OS 11.2.7",
|
||
"PAN-OS 11.2.6",
|
||
"PAN-OS 11.2.5",
|
||
"PAN-OS 11.2.4-h11",
|
||
"PAN-OS 11.2.4-h10",
|
||
"PAN-OS 11.2.4-h9",
|
||
"PAN-OS 11.2.4-h8",
|
||
"PAN-OS 11.2.4-h7",
|
||
"PAN-OS 11.2.4-h6",
|
||
"PAN-OS 11.2.4-h5",
|
||
"PAN-OS 11.2.4-h4",
|
||
"PAN-OS 11.2.4-h3",
|
||
"PAN-OS 11.2.4-h2",
|
||
"PAN-OS 11.2.4-h1",
|
||
"PAN-OS 11.2.4",
|
||
"PAN-OS 11.2.3-h5",
|
||
"PAN-OS 11.2.3-h4",
|
||
"PAN-OS 11.2.3-h3",
|
||
"PAN-OS 11.2.3-h2",
|
||
"PAN-OS 11.2.3-h1",
|
||
"PAN-OS 11.2.3",
|
||
"PAN-OS 11.2.2-h2",
|
||
"PAN-OS 11.2.2-h1",
|
||
"PAN-OS 11.2.1-h1",
|
||
"PAN-OS 11.2.1",
|
||
"PAN-OS 11.2.0-h1",
|
||
"PAN-OS 11.2.0",
|
||
"PAN-OS 11.1.9",
|
||
"PAN-OS 11.1.8",
|
||
"PAN-OS 11.1.6-h14",
|
||
"PAN-OS 11.1.6-h10",
|
||
"PAN-OS 11.1.6-h7",
|
||
"PAN-OS 11.1.6-h6",
|
||
"PAN-OS 11.1.6-h4",
|
||
"PAN-OS 11.1.6-h3",
|
||
"PAN-OS 11.1.6-h2",
|
||
"PAN-OS 11.1.6-h1",
|
||
"PAN-OS 11.1.6",
|
||
"PAN-OS 11.1.5-h1",
|
||
"PAN-OS 11.1.5",
|
||
"PAN-OS 11.1.4-h18",
|
||
"PAN-OS 11.1.4-h17",
|
||
"PAN-OS 11.1.4-h15",
|
||
"PAN-OS 11.1.4-h13",
|
||
"PAN-OS 11.1.4-h12",
|
||
"PAN-OS 11.1.4-h11",
|
||
"PAN-OS 11.1.4-h10",
|
||
"PAN-OS 11.1.4-h9",
|
||
"PAN-OS 11.1.4-h8",
|
||
"PAN-OS 11.1.4-h7",
|
||
"PAN-OS 11.1.4-h6",
|
||
"PAN-OS 11.1.4-h5",
|
||
"PAN-OS 11.1.4-h4",
|
||
"PAN-OS 11.1.4-h3",
|
||
"PAN-OS 11.1.4-h2",
|
||
"PAN-OS 11.1.4-h1",
|
||
"PAN-OS 11.1.4",
|
||
"PAN-OS 11.1.3-h13",
|
||
"PAN-OS 11.1.3-h12",
|
||
"PAN-OS 11.1.3-h11",
|
||
"PAN-OS 11.1.3-h10",
|
||
"PAN-OS 11.1.3-h9",
|
||
"PAN-OS 11.1.3-h8",
|
||
"PAN-OS 11.1.3-h7",
|
||
"PAN-OS 11.1.3-h6",
|
||
"PAN-OS 11.1.3-h5",
|
||
"PAN-OS 11.1.3-h4",
|
||
"PAN-OS 11.1.3-h3",
|
||
"PAN-OS 11.1.3-h2",
|
||
"PAN-OS 11.1.3-h1",
|
||
"PAN-OS 11.1.3",
|
||
"PAN-OS 11.1.2-h18",
|
||
"PAN-OS 11.1.2-h17",
|
||
"PAN-OS 11.1.2-h16",
|
||
"PAN-OS 11.1.2-h15",
|
||
"PAN-OS 11.1.2-h14",
|
||
"PAN-OS 11.1.2-h13",
|
||
"PAN-OS 11.1.2-h12",
|
||
"PAN-OS 11.1.2-h11",
|
||
"PAN-OS 11.1.2-h10",
|
||
"PAN-OS 11.1.2-h9",
|
||
"PAN-OS 11.1.2-h8",
|
||
"PAN-OS 11.1.2-h7",
|
||
"PAN-OS 11.1.2-h6",
|
||
"PAN-OS 11.1.2-h5",
|
||
"PAN-OS 11.1.2-h4",
|
||
"PAN-OS 11.1.2-h3",
|
||
"PAN-OS 11.1.2-h2",
|
||
"PAN-OS 11.1.2-h1",
|
||
"PAN-OS 11.1.2",
|
||
"PAN-OS 11.1.1-h2",
|
||
"PAN-OS 11.1.1-h1",
|
||
"PAN-OS 11.1.1",
|
||
"PAN-OS 11.1.0-h4",
|
||
"PAN-OS 11.1.0-h3",
|
||
"PAN-OS 11.1.0-h2",
|
||
"PAN-OS 11.1.0-h1",
|
||
"PAN-OS 11.1.0"
|
||
],
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.1.0-dev"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-08-13T20:32:04.428121Z",
|
||
"id": "CVE-2025-2182",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-08-13T20:32:15.474Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |