CVE-2025-2182: Palo Alto Networks Cloud NGFW · Cleartext Storage of Sensitive Information

Attack Vector: Physical

The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack) or persistent.

Attack Complexity: Low

The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.

Attack Requirements: Present

The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack. These include: a race condition must be won to successfully exploit the vulnerability (the successfulness of the attack is conditioned on execution conditions that are not under full control of the attacker, or the attack may need to be launched multiple times against a single target before being successful); the attacker must inject themselves into the logical network path between the target and the resource requested by the victim (e.g. vulnerabilities requiring an on-path attacker).

Privileges Required: High

The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files.

User Interaction: None

The vulnerable system can be exploited without interaction from any human user, other than the attacker.

Vulnerable system confidentiality: High

There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Vulnerable system integrity: None

There is no loss of integrity within the Vulnerable System.

Vulnerable system availability: None

There is no impact to availability within the Vulnerable System.

Subsequent system confidentiality: High

There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Subsequent system integrity: None

There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.

Subsequent system availability: None

There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Automatable: No

Attackers cannot reliably automate all 4 steps of the kill chain for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation.

Recovery: Automatic

The system recovers services automatically after an attack has been performed.

Value Density: Diffuse

The vulnerable system has limited resources. That is, the resources that the attacker will gain control over with a single exploitation event are relatively small. An example of Diffuse (think: limited) Value Density would be an attack on a single email client vulnerability.

Vulnerability Response Effort: Moderate

The actions required to respond to a vulnerability require some effort on behalf of the consumer and could cause minimal service impact to implement. Examples include: simple remote update, disabling of a subsystem, or a low-touch software upgrade such as a driver update.

Provider Urgency: Amber

Provider has assessed the impact of this vulnerability as having a moderate urgency.

Definitions: FIRST CVSS v4.0 specification.