Home

Description

A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations. The attacker must have network access to the Broker VM to exploit this issue.

PUBLISHED Reserved 2025-03-10 | Published 2025-08-13 | Updated 2025-08-13 | Assigner palo_alto




MEDIUM: 5.3CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber

Problem types

CWE-1392: Use of Default Credentials

Product status

Default status
unaffected

28.0.0 before 28.0.52
affected

Timeline

2025-08-13:Initial Publication

Credits

This issue was discovered during an internal penetration test. finder

References

security.paloaltonetworks.com/CVE-2025-2184 vendor-advisory

cve.org (CVE-2025-2184)

nvd.nist.gov (CVE-2025-2184)

Download JSON