CVE-2025-2182
PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)
Description
A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.
Weakness: CWE-312
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW | Firewall / NGFW | cna-assigner |
| Palo Alto Networks | PAN-OS | Firewall / NGFW | cna-assigner |
| Palo Alto Networks | Prisma Access | SASE / SSE / Secure Web | cna-assigner |
Vendor-reported affected versions (4)
- Palo Alto Networks · Cloud NGFW
- Palo Alto Networks · PAN-OS
- Palo Alto Networks · PAN-OS
- Palo Alto Networks · Prisma Access
Credit
This issue was found during an internal security review.
Vendor remediation
Version Minor Version Suggested Solution Cloud NGFW No action needed. PAN-OS 11.2 on PA-7500 11.2.0 through 11.2.7 Upgrade to 11.2.8 or later. PAN-OS 11.1 on PA-7500 11.1.0 through 11.1.9 Upgrade to 11.1.10 or later. PAN-OS 10.2 on PA-7500 No action needed.PAN-OS 10.1 on PA-7500 No action needed.PAN-OS on devices other than PA-7500 No action needed.All older unsupported PAN-OS versions Upgrade to a supported fixed version.Prisma Access No action needed.