Palo Alto Cloud NGFW/PAN-OS/Prisma Access IPSec cleartext transmission

Summaryinfo

A vulnerability was found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. It has been rated as problematic. Affected is an unknown function of the component IPSec. The manipulation leads to cleartext transmission. This vulnerability is referenced as CVE-2025-0136. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access (version unknown). This issue affects an unknown function of the component IPSec. The manipulation with an unknown input leads to a cleartext transmission vulnerability. Using CWE to declare the problem leads to CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Impacted is confidentiality. The summary by CVE is:

Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall through IPSec. This issue does not affect Cloud NGFWs, Prisma® Access instances, or PAN-OS VM-Series firewalls. NOTE: The AES-128-CCM encryption algorithm is not recommended for use.

The weakness was published by Benjamin Bai. The advisory is shared at security.paloaltonetworks.com. The identification of this vulnerability is CVE-2025-0136 since 12/21/2024. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1040 for this issue.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto

Name

• Cloud NGFW
• PAN-OS
• Prisma Access

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion