CVE-2025-4615

🗓️ 09 Oct 2025 18:28:04Reported by palo_altoType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 40 Views🌐 WEB

Authenticated admin can bypass restrictions via improper input neutralization in PAN-OS web interface.

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for Improper Neutralization of Script in Attributes in a Web Page in Paloaltonetworks Pan-Os	26 Mar 202620:29	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os	15 Feb 202617:40	–	githubexploit
Circl	CVE-2025-4615	8 Oct 202516:19	–	circl
CNNVD	Palo Alto Networks PAN-OS 安全漏洞	9 Oct 202500:00	–	cnnvd
CNVD	Unspecified Vulnerability in Palo Alto Networks PAN-OS (CNVD-2025-24729)	21 Oct 202500:00	–	cnvd
Cvelist	CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface	9 Oct 202518:28	–	cvelist
EUVD	EUVD-2025-33583	9 Oct 202521:31	–	euvd
NVD	CVE-2025-4615	9 Oct 202519:15	–	nvd
Tenable Nessus	Palo Alto Networks PAN-OS 10.2.x < 10.2.17 / 11.1.x < 11.1.6-h21 / 11.1.7-10.x < 11.1.10-h7 / 11.2.x < 11.2.8 Vulnerability	8 Oct 202500:00	–	nessus
Tenable Nessus	Siemens APE1808 Improper Neutralization of Script in Attributes in a Web Page (CVE-2025-4615)	23 Mar 202600:00	–	nessus

NVD

Vulners

CNA

Node

paloaltonetworks pan-osRange10.2.0–10.2.17

paloaltonetworks pan-osRange11.1.0–11.1.11

paloaltonetworks pan-osRange11.2.0–11.2.8

[
  {
    "vendor": "Palo Alto Networks",
    "product": "Cloud NGFW",
    "versions": [
      {
        "status": "unaffected",
        "version": "All",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Palo Alto Networks",
    "product": "PAN-OS",
    "versions": [
      {
        "status": "unaffected",
        "version": "12.1.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "11.2.0",
        "lessThan": "11.2.8",
        "changes": [
          {
            "at": "11.2.8",
            "status": "unaffected"
          }
        ],
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "11.1.0",
        "lessThan": "11.1.4-h27",
        "changes": [
          {
            "at": "11.1.10-h7",
            "status": "unaffected"
          },
          {
            "at": "11.1.6-h21",
            "status": "unaffected"
          },
          {
            "at": "11.1.4-h27",
            "status": "unaffected"
          }
        ],
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.2.0",
        "lessThan": "10.2.17",
        "changes": [
          {
            "at": "10.2.17",
            "status": "unaffected"
          }
        ],
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Palo Alto Networks",
    "product": "Prisma Access",
    "versions": [
      {
        "status": "unaffected",
        "version": "All",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
security	www.security.paloaltonetworks.com/CVEN-2025-4615

Parameter	Position	Path	Description	CWE
type	request body	/api/	Config set via API to modify secure-proxy-user (vulnerable to newline injection)	CWE-83
action	request body	/api/	Config set via API to modify secure-proxy-user (vulnerable to newline injection)	CWE-83
key	request body	/api/	Config set via API to modify secure-proxy-user (vulnerable to newline injection)	CWE-83
xpath	request body	/api/	Config set via API to modify secure-proxy-user (vulnerable to newline injection)	CWE-83
element	request body	/api/	Config set via API to modify secure-proxy-user (vulnerable to newline injection)	CWE-83
type	query param	/api/?type=commit&cmd=&key=	Commit endpoint that triggers writing of nginx.conf with the injected value	CWE-83
cmd	query param	/api/?type=commit&cmd=&key=	Commit endpoint that triggers writing of nginx.conf with the injected value	CWE-83
key	query param	/api/?type=commit&cmd=&key=	Commit endpoint that triggers writing of nginx.conf with the injected value	CWE-83

01 Apr 2026 01:16Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.2

CVSS 47

EPSS0.00057

SSVC

CWE-83