Riskcovery

CVE-2025-2182

PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)

State
Published
Severity
5.6 Medium
Published
Aug 13, 2025
Updated
Aug 13, 2025
Reserved
Mar 10, 2025

Read the record on cve.org

Description

A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.

Scores

CVSSScoreVectorSource
4.05.6 MediumCVSS:4.0/AV:P/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amberpalo_alto

Weaknesses

  • CWE-312 Cleartext Storage of Sensitive Information

Affected Products

ProductVersions
Cloud NGFWPalo Alto Networks
  • All to before 3.2.449Not affectedfrom 3.2.449Not affected
PAN-OSPalo Alto Networks
  • 11.2.0 to before 11.2.8Affectedfrom 11.2.8Not affected
  • 11.1.0 to before 11.1.10Affectedfrom 11.1.10Not affected
  • 10.2.0Not affected
  • 10.1.0Not affected
PAN-OSPalo Alto Networks
  • AllNot affected
Prisma AccessPalo Alto Networks
  • AllNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.