CVE-2025-4229Low

CVE-2025-4229 PAN-OS: Traffic Information Disclosure Vulnerability

Published
June 11, 2025
Last Modified
June 30, 2025

🔗 CVE IDs covered (1)

CVE-2025-4229 →

📋 Description

An information disclosure vulnerability in the SD-WAN feature of Palo Alto Networks PAN-OS® software enables an unauthorized user to view unencrypted data sent from the firewall through the SD-WAN interface. This requires the user to be able to intercept packets sent from the firewall. Cloud NGFW and Prisma® Access are not affected by this vulnerability.

🎯 Affected products3

  • Cloud NGFW
  • PAN-OS
  • Prisma Access

✅ Remediation

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW All No action needed. PAN-OS 11.2 11.2.0 through 11.2.6 Upgrade to 11.2.7 or later. PAN-OS 11.1 11.1.0 through 11.1.9 Upgrade to 11.1.10 or later. PAN-OS 10.2 10.2.0 through 10.2.16 Upgrade to 10.2.16-h1 or 10.2.17 or later. PAN-OS 10.1 10.1.0 through 10.1.14 Upgrade to 10.1.14-h16 or later. All older   Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access All No action needed. Workarounds and mitigations: If you are not using the SD-WAN feature of PAN-OS, you can mitigate this issue by disabling the SD-WAN feature. To disable SD-WAN feature, see our documentation about uninstalling SD-WAN plugin (https://docs.paloaltonetworks.com/sd-wan/activation-and-onboarding/uninstall-the-sd-wan-plugin). If you are using the SD-WAN feature but do not need Direct Internet Access, you can mitigate the issue by disabling Direct Internet Access on the SD-WAN Interface Profile by backhauling your internet traffic to SD-WAN hub (https://docs.paloaltonetworks.com/sd-wan/administration/configure-direct-internet-access/backhaul-your-internet-traffic-to-sd-wan-hub).

🔗 References (1)