CVE-2025-4230

PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI

View on CVE.org
Published Jun 12, 2025 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Description
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Remediation

Vendor Workaround

No workaround or mitigation is available.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-18226 A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00178}

 epss

{'score': 0.00173}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Title PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI
First Time appeared Palo Alto Networks
Palo Alto Networks pan-os
Weaknesses CWE-78
CPEs cpe:2.3:o:palo_alto_networks:pan-os:10.1.0:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.10:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.11:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.12:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.13:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:-:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h10:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h11:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h13:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h14:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h1:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h2:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h3:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h4:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h5:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h6:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h7:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h8:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:h9:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.7:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*
Vendors & Products Palo Alto Networks
Palo Alto Networks pan-os
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/V:D/U:Amber'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
palo_alto
Published
Updated
Feb 26, 2026, 5:50 PM
Reserved
May 2, 2025, 7:10 PM

View source JSON

Updated
Jun 13, 2025, 1:32 PM

JSON

Status
Deferred
Published
Jun 13, 2025, 12:15 AM
Modified
Jun 17, 2026, 9:32 AM

View source JSON

No data.

No data.