CVE-2025-0130Medium

CVE-2025-0130 PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets

Published
May 14, 2025
Last Modified
May 14, 2025

🔗 CVE IDs covered (1)

CVE-2025-0130 →

📋 Description

A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this condition will cause the firewall to enter maintenance mode. This issue does not affect Cloud NGFW or Prisma Access.

🎯 Affected products3

  • Cloud NGFW
  • PAN-OS
  • Prisma Access

✅ Remediation

VERSION MINOR VERSION SUGGESTED SOLUTION PAN-OS 11.2 11.2.0 through 11.2.4 Upgrade to 11.2.5 or later. PAN-OS 11.1 11.1.0 through 11.1.7 Upgrade to 11.1.7-h2 or 11.1.8 or later.   11.1.0 through 11.1.6 Upgrade to 11.1.6-h1 or 11.1.8 or later. PAN-OS 11.0 (EoL) Upgrade to a supported fixed version. PAN-OS 10.2 No action needed. PAN-OS 10.1 No action needed. All other   Upgrade to a supported fixed version. unsupported PAN-OS versions Workarounds and mitigations: If you are not using the web proxy feature, you can disable it to mitigate this issue. For more information regarding the web proxy feature, see our documentation regarding the web proxy feature (https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/networking-features/web-proxy).

🔗 References (1)