CVE-2025-0116 PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted LLDP Frame
Description
A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a specially crafted LLDP frame sent by an unauthenticated adjacent attacker. Repeated attempts to initiate this condition causes the firewall to enter maintenance mode.
This issue does not apply to Cloud NGFWs or Prisma Access software.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 11.2 | < 11.2.5 | >= 11.2.5 |
| PAN-OS 11.1 | < 11.1.8 | >= 11.1.8 (ETA: 3/20/2025) |
| PAN-OS 10.2 | < 10.2.13-h5 < 10.2.14 | >= 10.2.13-h5 >= 10.2.14 (ETA: 4/3/2025) |
| PAN-OS 10.1 | < 10.1.14-h11 | >= 10.1.14-h11 |
| Prisma Access | None | All |
Please note that PAN-OS 11.0, PAN-OS 10.0, PAN-OS 9.1, PAN-OS 9.0, and older releases have reached their software end-of-life (EoL) dates and are no longer evaluated for vulnerabilities and no fixes are planned. These versions are presumed to be affected.
Required Configuration for Exposure
To be vulnerable, all of the following conditions must be true:
- You must have enabled LLDP in your PAN-OS software to be vulnerable to this issue. You can verify whether you have LLDP enabled by following these steps in your web interface:
- Select Network > LLDP.
- In the LLDP General settings, verify whether LLDP is enabled (checked).
- Select Network > LLDP.
- LLDP must be enabled on at least one network interface. You can verify whether you have LLDP enabled on an interface by following these steps in your web interface:
- Select Network > LLDP.
- Verify if any interfaces are listed
- Verify if for any listed interface LLDP is enabled (checked)
- The LLDP profile associated with the an interface must have the "Mode" configured to "transmit-receive" or "receive-only". You can verify the "Mode" in your LLDP profile by following these steps in your web interface:
- Select Network > LLDP.
- For any interfaces where LLDP is enabled, find the profile associated with it.
- Select Network > Network Profiles > LLDP Profile
- Select the profile used with the interface
- Verify if the "Mode" is set to "transmit-receive" or "receive-only".
Severity: MEDIUM, Suggested Urgency: MODERATE
CVSS-BT: 4.3 / CVSS-B: 6.8 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
CWE-754 Improper Check for Unusual or Exceptional Conditions
CAPEC-153 Input Data Manipulation
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| PAN-OS 11.2 | 11.2.0 through 11.2.4 | Upgrade to 11.2.5 or later |
| PAN-OS 11.1 | 11.1.0 through 11.1.7 | Upgrade to 11.1.8 or later |
| PAN-OS 11.0 (EoL) | Upgrade to a supported fixed version | |
| PAN-OS 10.2 | 10.2.13 | Upgrade to 10.2.13-h5 or 10.2.14 or later |
| 10.2.0 through 10.2.13 | Upgrade to 10.2.14 or later | |
| PAN-OS 10.1 | 10.1.0 through 10.1.14 | Upgrade to 10.1.14-h11 or later |
| All other older unsupported PAN-OS versions | Upgrade to a supported fixed version. |
Workarounds and Mitigations
Option 1:
If you are not using LLDP, you should disable it to mitigate this issue by performing the following steps in your web interface:
- Select Network > LLDP.
- Open LLDP General settings.
- Disable (uncheck) LLDP.
Option 2:
You can disable LLDP for your network interfaces by performing the following steps in your web interface:
- Select Network > Interfaces and select the interface you wish to disable LLDP for.
- Select Advanced > LLDP.
- Disable (uncheck) LLDP.
Option 3:
If you are using LLDP only to advertise information about your PAN-OS device to other neighboring devices, you should set the LLDP mode to transmit-only for the profile used on your network interfaces by performing the following steps in your web interface:
- Select Network > Network Profiles > LLDP Profile
- Select the profile used with the interface
- Set the "Mode" to "transmit-only".
Acknowledgments
CPEs
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.3:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:*:*:*:*:*:*:*