CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Palo Alto Networks Security Advisories / CVE-2025-4615

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Urgency MODERATE

Severity 4.5 · MEDIUM

Exploit Maturity UNREPORTED

Response Effort MODERATE

Recovery USER

Value Density DIFFUSE

Attack Vector ADJACENT

Attack Complexity LOW

Attack Requirements NONE

Automatable NO

User Interaction NONE

Product Confidentiality NONE

Product Integrity HIGH

Product Availability HIGH

Privileges Required HIGH

Subsequent Confidentiality NONE

Subsequent Integrity NONE

Subsequent Availability NONE

CVE JSON CSAF

Published 2025-10-08

Updated 2025-10-08

Reference PAN-292159, PAN-271221

Discovered externally

Description

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Product Status

Versions	Affected	Unaffected
Cloud NGFW	None	All
PAN-OS 12.1	None	All
PAN-OS 11.2	< 11.2.8	>= 11.2.8
PAN-OS 11.1	< 11.1.11	>= 11.1.11
PAN-OS 10.2	< 10.2.17	>= 10.2.17
Prisma Access	None	All

Severity: MEDIUM, Suggested Urgency: MODERATE

You can greatly reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface. This will ensure that attacks can succeed only if they obtain privileged access through those specified IP addresses. We recommend remediating this vulnerability in your next scheduled maintenance cycle.
MEDIUM - CVSS-BT: 4.5 /CVSS-B: 6.9 (CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)

The risk is highest when you allow access to the management interface from external IP addresses on the internet. Our recommendation is to remediate as soon as possible.
MEDIUM - CVSS-BT: 4.8 /CVSS-B: 7.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-83 Improper Neutralization of Script in Attributes in a Web Page

CAPEC-165 File Manipulation

Solution

Version	Minor Version	Suggested Solution
Cloud NGFW		No action needed.
PAN-OS 12.1		No action needed.
PAN-OS 11.2	11.2.0 through 11.2.7	Upgrade to 11.2.8 or later.
PAN-OS 11.1	11.1.0 through 11.1.10	Upgrade to 11.1.11 or later.
PAN-OS 10.2	10.2.0 through 10.2.16	Upgrade to 10.2.17 or later.
Prisma Access		No action needed.

Workarounds and Mitigations

No known workarounds exist for this issue.

Acknowledgments

Palo Alto Networks thanks Visa Inc. for discovering and reporting this issue.

CPE Applicability

cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.0 and up to (excluding)11.2.8
ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.0 and up to (excluding)11.1.11
ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.0 and up to (excluding)10.2.17

Timeline

2025-10-08 Initial Publication