Palo Alto Cortex XDR Broker VM up to 28.0.51 default credentials

Summaryinfo

A vulnerability marked as problematic has been reported in Palo Alto Cortex XDR Broker VM up to 28.0.51. This affects an unknown function. The manipulation leads to default credentials. This vulnerability is traded as CVE-2025-2184. It is possible to launch the attack on the physical device. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Palo Alto Cortex XDR Broker VM up to 28.0.51 and classified as problematic. This issue affects an unknown code. The manipulation with an unknown input leads to a default credentials vulnerability. Using CWE to declare the problem leads to CWE-1392. The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations. The attacker must have network access to the Broker VM to exploit this issue.

The advisory is shared at security.paloaltonetworks.com. The identification of this vulnerability is CVE-2025-2184 since 03/10/2025. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 28.0.52 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-1818). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Palo Alto Networks Cortex XDR

Productinfo

Vendor

• Palo Alto

Name

• Cortex XDR Broker VM

Version

• 28.0.0
• 28.0.1
• 28.0.2
• 28.0.3
• 28.0.4
• 28.0.5
• 28.0.6
• 28.0.7
• 28.0.8
• 28.0.9
• 28.0.10
• 28.0.11
• 28.0.12
• 28.0.13
• 28.0.14
• 28.0.15
• 28.0.16
• 28.0.17
• 28.0.18
• 28.0.19
• 28.0.20
• 28.0.21
• 28.0.22
• 28.0.23
• 28.0.24
• 28.0.25
• 28.0.26
• 28.0.27
• 28.0.28
• 28.0.29
• 28.0.30
• 28.0.31
• 28.0.32
• 28.0.33
• 28.0.34
• 28.0.35
• 28.0.36
• 28.0.37
• 28.0.38
• 28.0.39
• 28.0.40
• 28.0.41
• 28.0.42
• 28.0.43
• 28.0.44
• 28.0.45
• 28.0.46
• 28.0.47
• 28.0.48
• 28.0.49
• 28.0.50
• 28.0.51

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion