CVEvulnerability

CVE-2025-4231

8.6 HIGH Published 2025-06-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-06-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77

Description

A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Affected configurations

• paloaltonetworks pan-os (>= 10.2.0 < 10.2.8) • paloaltonetworks pan-os (>= 11.0.0 < 11.0.3)

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References