Vulnerability · Published Apr 11, 2025 · Assigned by palo_alto

CVE-2025-0128PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet

High 8.7

In plain English

A high-severity security flaw in Cloud NGFW from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 74.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Cloud NGFW is not affected by this vulnerability. Prisma® Access software is proactively patched and protected from this issue.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	Cloud NGFW	see references
Palo Alto Networks	PAN-OS	11.2.0 – before 11.2.311.1.0 – before 11.1.511.0.0 – before 11.0.610.2.0 – before 10.2.10-h1710.1.0 – before 10.1.14-h11
Palo Alto Networks	Prisma Access	10.2.0 – before 10.2.4-h3611.2.0 – before 11.2.4-h5

Weakness: CWE-754 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber

References

https://security.paloaltonetworks.com/CVE-2025-0128 vendor-advisory