{"id":"CVE-2025-0137","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-0137","generatedAt":"2026-10-28T02:15:07.779Z","title":"An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator.","description":"An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator.\n\n\nThe attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .","published":"2025-05-14T19:15:52.000Z","lastModified":"2026-06-17T08:25:57.000Z","status":"Deferred","sourceIdentifier":"psirt@paloaltonetworks.com","cvss":{"version":"4.0","score":4.8,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-83"],"affected":[],"epss":{"score":0.00417,"percentile":0.35812,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2025-0137","source":"psirt@paloaltonetworks.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-0137","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}