{ "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", "CVE_data_meta": { "ID": "CVE-2025-0123", "ASSIGNER": "psirt@paloaltonetworks.com", "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability in the Palo Alto Networks PAN-OS\u00ae software enables unlicensed administrators to view clear-text data captured using the packet capture feature https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-packet-captures/take-a-custom-packet-capture in decrypted HTTP/2 data streams traversing network interfaces on the firewall. HTTP/1.1 data streams are not impacted.\n\nIn normal conditions, decrypted packet captures are available to firewall administrators after they obtain and install a free Decryption Port Mirror license. The license requirement ensures that this feature can only be used after approved personnel purposefully activate the license. For more information, review how to configure decryption port mirroring https://docs.paloaltonetworks.com/network-security/decryption/administration/monitoring-decryption/configure-decryption-port-mirroring .\n\nThe administrator must obtain network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. Risk of this issue can be greatly reduced by restricting access to the management interface to only trusted administrators and from only internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nCustomer firewall administrators do not have access to the packet capture feature in Cloud NGFW. This feature is available only to authorized Palo Alto Networks personnel permitted to perform troubleshooting.\n\nPrisma\u00ae Access is not impacted by this vulnerability." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-312 Cleartext Storage of Sensitive Information", "cweId": "CWE-312" } ] } ] }, "affects": { "vendor": { "vendor_data": [ { "vendor_name": "Palo Alto Networks", "product": { "product_data": [ { "product_name": "Cloud NGFW", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "status": "unaffected", "version": "All", "versionType": "custom" } ], "defaultStatus": "unaffected" } } ] } }, { "product_name": "PAN-OS", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "changes": [ { "at": "11.2.6", "status": "unaffected" } ], "lessThan": "11.2.6", "status": "affected", "version": "11.2.0", "versionType": "custom" }, { "changes": [ { "at": "11.1.8", "status": "unaffected" } ], "lessThan": "11.1.8", "status": "affected", "version": "11.1.0", "versionType": "custom" }, { "changes": [ { "at": "10.2.15", "status": "unaffected" } ], "lessThan": "10.2.15", "status": "affected", "version": "10.2.0", "versionType": "custom" }, { "changes": [ { "at": "10.1.14-h13", "status": "unaffected" } ], "lessThan": "10.1.14-h13", "status": "affected", "version": "10.1.0", "versionType": "custom" } ], "defaultStatus": "unaffected" } } ] } }, { "product_name": "Prisma Access", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "status": "unaffected", "version": "All", "versionType": "custom" } ], "defaultStatus": "unaffected" } } ] } } ] } } ] } }, "references": { "reference_data": [ { "url": "https://security.paloaltonetworks.com/CVE-2025-0123", "refsource": "MISC", "name": "https://security.paloaltonetworks.com/CVE-2025-0123" } ] }, "generator": { "engine": "Vulnogram 0.1.0-dev" }, "source": { "defect": [ "PAN-257442" ], "discovery": "INTERNAL" }, "configuration": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "This vulnerability requires the following configuration:
  1. An SSL decryption policy matching HTTP/2 data flows tied to a decryption profile without 'Strip ALPN' enabled;
    and
  2. Global HTTP/2 inspection enabled.

    Note: Global HTTP/2 inspection is enabled by default. The setting to disable it is available only by using the PAN-OS command-line interface (CLI). To verify whether this feature is globally disabled use the following CLI commands:

    > set cli config-output-format set
    > configure
    # show | match 'http2 enable no'

    \u2003\u2003- If there is no output, then http2 inspection is enabled.
    \u2003\u2003- If output shows 'set deviceconfig setting http2 enable no' then http2 traffic is classified as unknown-tcp and is not decrypted by the firewall, which makes clear-text data unreadable in packet captures.
    \u2003\u2003
" } ], "value": "This vulnerability requires the following configuration: * An SSL decryption policy matching HTTP/2 data flows tied to a decryption profile without 'Strip ALPN' enabled;\nand\n * Global HTTP/2 inspection enabled.\n\nNote: Global HTTP/2 inspection is enabled by default. The setting to disable it is available only by using the PAN-OS command-line interface (CLI). To verify whether this feature is globally disabled use the following CLI commands:> set cli config-output-format set\n>\u00a0configure \n# show | match\u00a0'http2 enable no'\n\n\u2003\u2003- If there is no output, then http2 inspection is enabled.\n\u2003\u2003- If output shows 'set deviceconfig setting http2 enable no' then http2 traffic is classified as unknown-tcp and is not decrypted by the firewall, which makes clear-text data unreadable in packet captures." } ], "work_around": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Mitigation: In a Palo Alto Networks firewall, you can configure the decryption profile to strip ALPN (Application-Layer Protocol Negotiation) from the TLS handshake, which is used to negotiate the application protocol (e.g., HTTP/2 or HTTP/1.1) for the secured connection. When ALPN is absent, the following behaviors can occur:
Consequently, without ALPN, the Palo Alto Networks firewall does not inspect HTTP/2 connections, which prevents decrypted HTTP/2 (clear-text) traffic exposure to firewall administrators.

You can review how to strip ALPN and disable HTTP/2 inspection for targeted traffic in the App-ID and HTTP/2 inspection technical documentation.

Additional mitigation: The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our critical deployment guidelines. Specifically, you should restrict management interface access to only trusted internal IP addresses.

Review information about how to secure management access to your Palo Alto Networks firewalls:
" } ], "value": "Mitigation: In a Palo Alto Networks firewall, you can configure the decryption profile to strip ALPN (Application-Layer Protocol Negotiation) from the TLS handshake, which is used to negotiate the application protocol (e.g., HTTP/2 or HTTP/1.1) for the secured connection. When ALPN is absent, the following behaviors can occur:\n * Firewall behavior\u2014With no ALPN value available, the firewall cannot perform HTTP/2 inspection. It either forces the connection to downgrade to HTTP/1.1 (by letting the client and server negotiate a fallback) or, if that downgrade isn\u2019t possible, it can classify the traffic as unknown-tcp and potentially affects your security policy rules and application identification.\n * Client behavior\u2014Most modern web browsers rely on ALPN to negotiate HTTP/2. If ALPN is missing, the client typically falls back to HTTP/1.1.\n * Server behavior\u2014If ALPN is absent, the server can assume that the client supports only HTTP/1.1 and downgrades the connection accordingly. If the server enforces HTTP/2-only connections, then it may reject the handshake and cause a connection failure.\n\n\nConsequently, without ALPN, the Palo Alto Networks firewall does not inspect HTTP/2 connections, which prevents decrypted HTTP/2 (clear-text) traffic exposure to firewall administrators.\n\nYou can review how to strip ALPN and disable HTTP/2 inspection for targeted traffic in the App-ID and HTTP/2 https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/app-id/http2#:~:text=Disable%20HTTP%2F2%20inspection%20for%20targeted%20traffic. inspection technical documentation.\n\nAdditional mitigation: The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Specifically, you should restrict management interface access to only trusted internal IP addresses.\n\nReview information about how to secure management access to your Palo Alto Networks firewalls:\n * Palo Alto Networks LIVEcommunity article: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-ac... https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 \n * Palo Alto Networks official and detailed technical documentation:\u00a0 https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administr... https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices" } ], "exploit": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue." } ], "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue." } ], "solution": [ { "lang": "eng", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "This issue is fixed in PAN-OS 10.1.14-h13, PAN-OS 10.2.15, PAN-OS 11.1.8, PAN-OS 11.2.6, and all later PAN-OS versions.

Version
Minor Version
Suggested Solution
PAN-OS 11.2
11.2.0 through 11.2.5Upgrade to 11.2.6 or later.
PAN-OS 11.111.1.0 through 11.1.7
Upgrade to 11.1.8 or later.
PAN-OS 11.0 (EoL)

Upgrade to a supported fixed version.
PAN-OS 10.2
10.2.0 through 10.2.14
Upgrade to 10.2.15 or later.

PAN-OS 10.1
10.1.0 through 10.1.14-h11
Upgrade to 10.1.14-h13 or later.
All other older
unsupported
PAN-OS versions		 Upgrade to a supported fixed version.

To fully remediate risk, you must delete all pre-existing packet capture files stored on the firewall after you upgrade to a fixed PAN-OS version. This task can be performed through the PAN-OS web interface or through the PAN-OS CLI.

Using the Web Interface:

1. Select Monitor > Packet Capture > Captured Files > (Select All) and Delete the files.
2. Select Yes when prompted by the confirmation dialog.

Using the PAN-OS CLI:

1. Enter the following operational command:

> delete debug-filter file * 

2. A confirmation prints to the terminal and indicates that all packet capture files were successfully deleted from the firewall:

successfully removed * 

" } ], "value": "This issue is fixed in PAN-OS 10.1.14-h13, PAN-OS 10.2.15, PAN-OS 11.1.8, PAN-OS 11.2.6, and all later PAN-OS versions.\n\nVersion\nMinor Version\nSuggested Solution\nPAN-OS 11.2\n11.2.0 through 11.2.5Upgrade to 11.2.6 or later.\nPAN-OS 11.111.1.0 through 11.1.7\nUpgrade to 11.1.8 or later.PAN-OS 11.0 (EoL)\n\nUpgrade to a supported fixed version.\nPAN-OS 10.2\n10.2.0 through 10.2.14\nUpgrade to 10.2.15 or later.\n\nPAN-OS 10.1\n10.1.0 through 10.1.14-h11\nUpgrade to 10.1.14-h13 or later.\nAll other older\nunsupported\nPAN-OS versions\u00a0Upgrade to a supported fixed version.\nTo fully remediate risk, you must delete all pre-existing packet capture files stored on the firewall after you upgrade to a fixed PAN-OS version. This task can be performed through the PAN-OS web interface or through the PAN-OS CLI.Using the Web Interface:\n\n1. Select Monitor > Packet Capture > Captured Files > (Select All) and Delete the files.\n2. Select Yes when prompted by the confirmation dialog.Using the PAN-OS CLI:\n\n1. Enter the following operational command:\n> delete debug-filter file *\u00a0\n\n2. A confirmation prints to the terminal and indicates that all packet capture files were successfully deleted from the firewall:\nsuccessfully removed *" } ], "credits": [ { "lang": "en", "value": "Saurabh Tripathi of Palo Alto Networks" } ] }