Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An improper access control vulnerability in the  Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement  feature of the Palo Alto Networks GlobalProtect™ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel.

An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one minute.

CVE-2025-4227 is a vulnerability identified in the Palo Alto Networks GlobalProtect App, specifically affecting versions 6.0.0 through 6.3.0. The flaw stems from improper access control within the Endpoint Traffic Policy Enforcement feature. This feature is designed to enforce traffic policies on endpoints by securing network packets within an encrypted tunnel. However, due to this vulnerability, certain packets are transmitted in cleartext rather than being properly encrypted inside the tunnel. This cleartext transmission exposes sensitive information to interception risks. An attacker with physical access to the network—such as someone connected to the same local network segment—can inject rogue devices to intercept these unencrypted packets. Despite this, the GlobalProtect app has a built-in recovery mechanism that automatically restores secure transmission within approximately one minute under normal conditions. The vulnerability is classified under CWE-319, which relates to the cleartext transmission of sensitive information. The CVSS v4.0 score assigned is 1.0, indicating a low severity level. The vector details show that exploitation requires physical access (AV:P), low attack complexity (AC:L), no privileges required (PR:N), but user interaction is necessary (UI:A). The impact on confidentiality is limited (V:D), with no impact on integrity or availability. No known exploits are reported in the wild, and no patches have been linked yet. Overall, this vulnerability represents a transient exposure window where sensitive data could be intercepted due to improper encryption enforcement, but the risk is mitigated by the app's automatic recovery and the requirement for physical network access and user interaction.

Detailed information about CVE-2025-4227: CWE-319 Cleartext Transmission of Sensitive Information in Palo Alto Networks GlobalProtect App affecting Palo Alto Ne

CVE-2025-4227: CWE-319 Cleartext Transmission of Sensitive Information in Palo Alto Networks GlobalProtect App - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'cve-2025-4227'

Filter Threats

Threats Tagged 'cve-2025-4227'