CVE-2025-0130CWE-754

PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets

High · published May 14, 2025

CVSS v4.0
8.2
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this condition will cause the firewall to enter maintenance mode.

This issue does not affect Cloud NGFW or Prisma Access.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Amber
EPSS
0.00442 · 37.4th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2025-05-14T17:37Z
EPSS history
Timeline
  • 14 MAY 17:37Z
    PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets
    cvelistv5