Skip to content
CVE PROGRAM SOURCE RECORD5.6 Medium

CVE-2025-2182

PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks Cloud NGFW

Default version status: unaffected

  • All to < 3.2.449unaffected

Palo Alto Networks PAN-OS

Default version status: unaffected

  • 11.2.0 to < 11.2.8affected
  • 11.1.0 to < 11.1.10affected
  • 10.2.0unaffected
  • 10.1.0unaffected

Palo Alto Networks PAN-OS

Default version status: unaffected

  • Allunaffected

Palo Alto Networks Prisma Access

Default version status: unaffected

  • Allunaffected

References