Loading HuntDB...

CVE-2025-0128

UNKNOWN
Published 2025-04-11T02:03:22.355Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-0128. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.

Cloud NGFW is not affected by this vulnerability. Prisma® Access software is proactively patched and protected from this issue.

Understanding This Vulnerability

This Common Vulnerabilities and Exposures (CVE) entry provides detailed information about a security vulnerability that has been publicly disclosed. CVEs are standardized identifiers assigned by MITRE Corporation to track and catalog security vulnerabilities across software and hardware products.

The severity rating (UNKNOWN) indicates the potential impact of this vulnerability based on the CVSS (Common Vulnerability Scoring System) framework. Higher severity ratings typically indicate vulnerabilities that could lead to more significant security breaches if exploited. Security teams should prioritize remediation efforts based on severity, exploit availability, and the EPSS (Exploit Prediction Scoring System) score, which predicts the likelihood of exploitation in the wild.

If this vulnerability affects products or systems in your infrastructure, we recommend reviewing the affected products section, checking for available patches or updates from vendors, and implementing recommended workarounds or solutions until a permanent fix is available. Organizations should also monitor security advisories and threat intelligence feeds for updates about active exploitation of this vulnerability.

Available Exploits

No exploits available for this CVE.

Related News

PAN-SA-2025-0015 Chromium: Monthly Vulnerability Update (September 2025) (Severity: MEDIUM)

Related content: CVE-2025-4235 User-ID Credential Agent: Cleartext Exposure of Service Account password (Severity: MEDIUM) CVE-2023-48795 Impact of Terrapin SSH Attack (Severity: MEDIUM) CVE-2025-0128 PAN-OS: Firewall Denial of Service (DoS) Using a Specially…

Paloaltonetworks.com 2025-09-10 16:00
CVE-2025-4234 Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials (Severity: LOW)

Related content: CVE-2025-4235 User-ID Credential Agent: Cleartext Exposure of Service Account password (Severity: MEDIUM) CVE-2023-48795 Impact of Terrapin SSH Attack (Severity: MEDIUM) CVE-2025-0128 PAN-OS: Firewall Denial of Service (DoS) Using a Specially…

Paloaltonetworks.com 2025-09-10 16:00
CVE-2025-4235 User-ID Credential Agent: Cleartext Exposure of Service Account password (Severity: MEDIUM)

Related content: CVE-2025-4234 Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials (Severity: LOW) CVE-2023-48795 Impact of Terrapin SSH Attack (Severity: MEDIUM) CVE-2025-0128 PAN-OS: Firewall Denial of Service (DoS) Using a Specially C…

Paloaltonetworks.com 2025-09-10 16:00
CVE-2025-0124 PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface (Severity: LOW)

Related content: CVE-2025-0125 PAN-OS: Improper Neutralization of Input in the Management Web Interface (Severity: MEDIUM) CVE-2025-0128 PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet (Severity: MEDIUM) PAN-SA-2025-0007 Chromium: Mo…

Paloaltonetworks.com 2025-04-09 16:00
CVE-2025-0120 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (Severity: MEDIUM)

Related content: CVE-2025-0124 PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface (Severity: LOW) CVE-2025-0128 PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet (Severity: MEDIUM) PAN-SA-2025-0007 Chromi…

Paloaltonetworks.com 2025-04-09 16:00

Affected Products

References

Workarounds

If you are not using SCEP, you can disable it to mitigate this risk by running the following command in your PAN-OS command-line interface (CLI):
> debug sslmgr set disable-scep-auth-cookie yes

CAUTION: This workaround is effective only until the next reboot, after which you must rerun this command to stay protected.

Solutions

Version
Minor Version
Suggested Solution
PAN-OS 11.2
11.2.0 through 11.2.2Upgrade to 11.2.3 or later
PAN-OS 11.111.1.0 through 11.1.4
Upgrade to 11.1.5 or laterPAN-OS 11.0
11.0.0 through 11.0.5
Upgrade to 11.0.6 or later
PAN-OS 10.2
10.2.0 through 10.2.10Upgrade to 10.2.11 or laterPAN-OS 10.1
10.1.0 through 10.1.14
Upgrade to 10.1.14-h11 or later
All other older
unsupported
PAN-OS versions Upgrade to a supported fixed version.
PAN-OS 11.0 is EoL. We listed it in this section for completeness because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 in any of your firewalls, we strongly recommend that you upgrade to a fixed supported version.

We proactively initiated the upgrade through Prisma Access March 21, 2025, to cover all tenants.

Credits & Acknowledgments

finder

Abyss Watcher

Timeline

Initial Publication

EU Vulnerability Database

Monitored by ENISA for EU cybersecurity

EU Coordination

EU Coordinated

Exploitation Status

No Known Exploitation

ENISA Analysis

Malicious code in bioql (PyPI)

Affected Products (ENISA)

palo alto networks
pan-os

ENISA Scoring

CVSS Score (4.0)

8.7
/10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber

EPSS Score

0.070
probability

Data provided by ENISA EU Vulnerability Database. Last updated: October 3, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-g8cx-ccc5-rjfw

Advisory Details

A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Cloud NGFW is not affected by this vulnerability. Prisma® Access software is proactively patched and protected from this issue.

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber

Advisory provided by GitHub Security Advisory Database. Published: April 11, 2025, Modified: April 11, 2025

References

Published: 2025-04-11T02:03:22.355Z
Last Modified: 2025-04-11T16:01:46.600Z
Copied to clipboard!