CVE-2025-0136: PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices (Severity: LOW)

Q: What is the severity of CVE-2025-0136?

CVE-2025-0136 has not been assigned a specific severity score but involves the potential for unencrypted data transfer in certain Palo Alto Networks PAN-OS firewalls.

Q: How do I fix CVE-2025-0136?

To mitigate CVE-2025-0136, upgrade to PAN-OS versions 10.1.14-h14, 10.2.11, 11.0.7, or 11.1.5 or later.

Q: Which Palo Alto Networks products are affected by CVE-2025-0136?

CVE-2025-0136 affects Palo Alto Networks PAN-OS firewalls including PA-7500, PA-5400, PA-3400, and PA-400 Series models.

Q: What type of vulnerability is CVE-2025-0136?

CVE-2025-0136 is a vulnerability related to the AES-128-CCM algorithm used for IPSec leading to potential unencrypted data transmission.

Q: When was CVE-2025-0136 reported?

CVE-2025-0136 was reported as a security vulnerability affecting specific versions of Palo Alto Networks PAN-OS.

Published May 14, 2025

Updated

Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall through IPSec.

This issue does not affect Cloud NGFWs, Prisma® Access instances, or PAN-OS VM-Series firewalls.

NOTE: The AES-128-CCM encryption algorithm is not recommended for use.

Other sources

Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall through IPSec.

This issue does not affect Cloud NGFWs, Prisma® Access instances, or PAN-OS VM-Series firewalls.

NOTE: The AES-128-CCM encryption algorithm is not recommended for use.

— MITRE

Affected Software

4 affected componentsFixes available

Palo Alto Networks PAN-OS

Palo Alto Networks Cloud NGFW

Palo Alto Networks PAN-OS<11.1.5, =11.1.0, <11.0.7, =11.0.0, <10.2.11, =10.2.0, <10.1.14-h14, =10.1.0

11.1.511.0.710.2.1110.1.14-h14

Palo Alto Networks Prisma Access

Remediation

Mitigation

Configure IPSec Crypto encryption to an algorithm that meets current security standards, such as AES-256-GCM or AES-256-CBC, on PA 7500, PA 5400, PA 5400f, PA 3400, PA 1400, and PA 400 series hardware PAN-OS firewalls. For more information on configuring the IPSec Crypto Profiles see our documentation (https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-site-to-site-vpn/define-cryptographic-profiles/define-ipsec-crypto-profiles).

Information

VERSION MINOR VERSION SUGGESTED SOLUTION PAN-OS 11.2 No action needed PAN-OS 11.1 11.1.0 through 11.1.4 Upgrade to 11.1.5 or later PAN-OS 11.0 11.0.0 through 11.0.6 Upgrade to 11.0.7 or later PAN-OS 10.2 10.2.0 through 10.2.10 Upgrade to 10.2.11 or later PAN-OS 10.1 10.1.0 through 10.1.14 Upgrade to 10.1.14-h14 or later All other older Upgrade to a supported fixed version. unsupported PAN-OS versions PAN-OS 11.0 is EoL. We listed it in this section for completeness and because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 on any of your firewalls, though, we strongly recommend that you upgrade to a supported (non-EoL) fixed version.

Event History

May 14, 2025

Advisory Published

via Palo Alto Networks·04:00 PM

CVE Published

via MITRE·06:12 PM

Data Sourced

via MITRE·06:12 PM

DescriptionWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-0136?

CVE-2025-0136 has not been assigned a specific severity score but involves the potential for unencrypted data transfer in certain Palo Alto Networks PAN-OS firewalls.

How do I fix CVE-2025-0136?