Home

Description

Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall through IPSec. This issue does not affect Cloud NGFWs, Prisma® Access instances, or PAN-OS VM-Series firewalls. NOTE: The AES-128-CCM encryption algorithm is not recommended for use.

PUBLISHED Reserved 2024-12-20 | Published 2025-05-14 | Updated 2025-05-14 | Assigner palo_alto




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber

Problem types

CWE-319 Cleartext Transmission of Sensitive Information

Product status

Default status
unaffected

All (custom)
unaffected

Default status
unaffected

11.2.0 (custom)
unaffected

11.1.0 (custom) before 11.1.5
affected

11.0.0 (custom) before 11.0.7
affected

10.2.0 (custom) before 10.2.11
affected

10.1.0 (custom) before 10.1.14-h14
affected

Default status
unaffected

All (custom)
unaffected

Timeline

2025-05-14:Initial Publication

Credits

Benjamin Bai of Palo Alto Networks finder

References

security.paloaltonetworks.com/CVE-2025-0136 vendor-advisory

cve.org (CVE-2025-0136)

nvd.nist.gov (CVE-2025-0136)

Download JSON