CVE-2025-2182 | THREATINT

Description

A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.

PUBLISHED Reserved 2025-03-10 | Published 2025-08-13 | Updated 2025-08-13 | Assigner palo_alto

MEDIUM: 5.6CVSS:4.0/AV:P/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amber

Problem types

CWE-312 Cleartext Storage of Sensitive Information

Product status

Default status

unaffected

All before 3.2.449

unaffected

Default status

unaffected

11.2.0 before 11.2.8

affected

11.1.0 before 11.1.10

affected

10.2.0

unaffected

10.1.0

unaffected

Default status

unaffected

All

unaffected

Default status

unaffected

All

unaffected

Timeline

2025-08-13:

Initial Publication

Credits

This issue was found during an internal security review. finder

References

security.paloaltonetworks.com/CVE-2025-2182 vendor-advisory

cve.org (CVE-2025-2182)

nvd.nist.gov (CVE-2025-2182)

Download JSON