CVE-2025-0122

Description

A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device.

Overview

State: PUBLISHED
Assigner (CNA): palo_alto
CVSS severity: MEDIUM
CVSS score: 5.1 / 10
CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:D/RE:L/U:Amber
Effective score: 5.1 / 10 MEDIUM source: CNA overview
CWE(s): CWE-770
Reserved: 2024-12-20
Published: 2025-04-11 01:48 UTC
Last updated: 2025-04-11 16:02 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/0xxx/CVE-2025-0122.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2025-04-11 02:15:18 UTC
NVD last modified: 2026-04-15 00:35:42 UTC
EPSS score: 0.0012 (probability of exploitation in next 30 days)
EPSS percentile: 30.09% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-15138
Assigner: palo_alto
Published: Apr 11, 2025, 1:48:04 AM
Updated: Apr 11, 2025, 4:02:27 PM
EUVD base score (CVSS 4.0): 5.1 / 10
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:D/RE:L/U:Amber
EUVD-reported EPSS: 0.1200
Vendors: Palo Alto Networks
Products: Prisma SD-WAN (6.2.0)

Prisma SD-WAN (6.4.0 <6.4.2)

Prisma SD-WAN (6.1.0 <6.1.10)

Prisma SD-WAN (6.5.0 <6.5.1)

Prisma SD-WAN (6.3.0 <6.3.4)
Aliases: GHSA-fwqw-7mw3-vq38

ENISA description: A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device.

EUVD references (1)

https://security.paloaltonetworks.com/CVE-2025-0122

Affected products (1)

Vendor	Product	Versions	Platforms
Palo Alto Networks	Prisma SD-WAN	`6.5.0` (affected), `6.4.0` (affected), `6.3.0` (affected), `6.2.0` (affected), `6.1.0` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://security.paloaltonetworks.com/CVE-2025-0122 vendor-advisory

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://security.paloaltonetworks.com/CVE-2025-0122 vendor-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://security.paloaltonetworks.com/CVE-2025-0122 psirt@paloaltonetworks.com

Remediations (10)

Microsoft December 2025 Patch Tuesday - 56 Vulnerabilities Fixed ...

web:cybersecuritynews.com

Microsoft released its final Patch Tuesday updates of 2025 on December 9, addressing 56 security vulnerabilities across Windows, Office, Exchange Server, and other components.

2026-05-23 21:16 UTC
Microsoft Patch Tuesday, September 2025 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known "zero-day" or actively exploited vulnerabilities ...

2026-05-23 21:16 UTC
Microsoft's Latest 'Patch Tuesday' Update Fixes These ... - Lifehacker

web:lifehacker.com

Microsoft's Patch Tuesday update for December is here, and Windows users should ensure their machines are updated as soon as possible to fix three zero-day vulnerabilities.

2026-05-23 21:16 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 21:16 UTC
Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit ...

web:thehackernews.com

Microsoft fixed 56 Windows security flaws, including an actively exploited privilege-escalation bug and two new command-injection zero-days.

2026-05-23 21:16 UTC
Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws

web:www.bleepingcomputer.com

Microsoft's December 2025 Patch Tuesday fixes 57 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

2026-05-23 21:16 UTC
February's Patch Tuesday release fixes 59 flaws ... - Computerworld

web:www.computerworld.com

Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

2026-05-23 21:16 UTC
December 2025 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft has released security updates for 57 vulnerabilities, including one actively exploited zero-day, two publicly disclosed zero-days, and two Critical, in its December 2025 Patch Tuesday rollout.

2026-05-23 21:16 UTC
Patch Tuesday 2025 Year In Review | Tenable®

web:www.tenable.com

Key takeaways: Microsoft's 2025 Patch Tuesday releases addressed 1,130 CVEs . This is the second year in a row where the CVE count was over 1,000. Elevation of Privilege vulnerabilities accounted for 38.3% of all Patch Tuesday vulnerabilities in 2025 , followed by Remote Code Execution flaws at 30.8%. 41 zero-day vulnerabilities were addressed across all Patch Tuesday releases in 2025 , including ...

2026-05-23 21:16 UTC
Microsoft just gave you another reason to update your PC — November's ...

web:www.tomsguide.com

November's Patch Tuesday updates fix 63 flaws in total but two of them are critical vulnerabilities that require your immediate attention.

2026-05-23 21:16 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-0122.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0122",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-11T15:38:04.495847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-11T16:02:27.010Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Prisma SD-WAN",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.5.1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.5.1",
              "status": "affected",
              "version": "6.5.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.4.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.4.2",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.3.4",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.3.4",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.1.10",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.1.10",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No special configuration is needed to be vulnerable to this issue."
            }
          ],
          "value": "No special configuration is needed to be vulnerable to this issue."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vajrapu Venkata Sarat Kumar of Palo Alto Networks"
        }
      ],
      "datePublic": "2025-04-09T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma\u00ae SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device."
            }
          ],
          "value": "A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma\u00ae SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-482",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-482 TCP Flood"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "AUTOMATIC",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:D/RE:L/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-11T01:48:04.772Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2025-0122"
        }
      ],
      "solutions": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<table class=\"tbl\"><thead><tr><th>Version</th><th>Suggested Solution</th></tr></thead><tbody><tr><td>Prisma SD-WAN 6.5</td><td>Upgrade to Prisma SD-WAN 6.5.1 or later</td></tr><tr><td>Prisma SD-WAN 6.4<br></td><td>Upgrade to Prisma SD-WAN 6.4.2 or later</td></tr><tr><td>Prisma SD-WAN 6.3</td><td>Upgrade to Prisma SD-WAN 6.3.4 or later</td></tr><tr><td>Prisma SD-WAN 6.2</td><td>Upgrade to&nbsp;Prisma SD-WAN 6.3.4 or later</td></tr><tr><td>Prisma SD-WAN 6.1</td><td>Upgrade to Prisma SD-WAN 6.1.10 or later</td></tr></tbody></table>"
            }
          ],
          "value": "VersionSuggested SolutionPrisma SD-WAN 6.5Upgrade to Prisma SD-WAN 6.5.1 or laterPrisma SD-WAN 6.4\nUpgrade to Prisma SD-WAN 6.4.2 or laterPrisma SD-WAN 6.3Upgrade to Prisma SD-WAN 6.3.4 or laterPrisma SD-WAN 6.2Upgrade to\u00a0Prisma SD-WAN 6.3.4 or laterPrisma SD-WAN 6.1Upgrade to Prisma SD-WAN 6.1.10 or later"
        }
      ],
      "source": {
        "defect": [
          "CGSDW-23881"
        ],
        "discovery": "INTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-09T16:00:00.000Z",
          "value": "Initial Publication"
        }
      ],
      "title": "Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through Burst of Crafted Packets",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no known workarounds for this issue."
            }
          ],
          "value": "There are no known workarounds for this issue."
        }
      ],
      "x_affectedList": [
        "Prisma SD-WAN 6.5.0",
        "Prisma SD-WAN 6.4.0",
        "Prisma SD-WAN 6.4.1",
        "Prisma SD-WAN 6.3.0",
        "Prisma SD-WAN 6.3.1",
        "Prisma SD-WAN 6.3.2",
        "Prisma SD-WAN 6.3.3",
        "Prisma SD-WAN 6.1.0",
        "Prisma SD-WAN 6.1.1",
        "Prisma SD-WAN 6.1.2",
        "Prisma SD-WAN 6.1.3",
        "Prisma SD-WAN 6.1.4",
        "Prisma SD-WAN 6.1.5",
        "Prisma SD-WAN 6.1.6",
        "Prisma SD-WAN 6.1.7",
        "Prisma SD-WAN 6.1.8",
        "Prisma SD-WAN 6.1.9"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2025-0122",
    "datePublished": "2025-04-11T01:48:04.772Z",
    "dateReserved": "2024-12-20T23:23:23.383Z",
    "dateUpdated": "2025-04-11T16:02:27.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}