Product:
PAN-OS
Summary
A denial-of-service vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to reboot a firewall by sending a specially crafted packet through the dataplane. Repeated attempts to initiate a reboot can cause the firewall to enter maintenance mode. This issue affects specific versions of PAN-OS on PA-Series firewalls, VM-Series firewalls, and Prisma Access software, but does not impact Cloud NGFW.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.6 | CVE-2025-4619 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted packets to the firewall’s dataplane. By repeatedly sending these packets, the attacker can trigger a reboot of the firewall, leading to a denial-of-service condition. This can disrupt network services and potentially force the firewall into maintenance mode, affecting its operational capabilities.
Affected Products
- PA-Series firewalls: Affected by the DoS vulnerability in PAN-OS.
- VM-Series firewalls: Vulnerable to the same issue as PA-Series.
- Prisma Access: Also impacted by the vulnerability in PAN-OS.
Mitigation
To mitigate this vulnerability, users should ensure they are running the latest version of PAN-OS that has been patched against this issue. Palo Alto Networks has completed upgrades for most customers and will continue to schedule upgrades for those facing issues. Regular monitoring and applying security updates can help prevent exploitation.