CVE-2025-2182 - PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)

Back Back to CVE browser

MEDIUM

PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)

Published Aug 13, 2025

5.6

MEDIUM

CVSS 4.0

EPSS 0.12%

Description

A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
unaffected
- Version
  11.1.0
  Status
  affected
  Constraints
  <11.1.10
- Version
  11.2.0
  Status
  affected
  Constraints
  <11.2.8
- Version
  10.1.0
  Status
  unaffected
  Constraints
  -
- Version
  10.2.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Pan-OS

unaffected

Version	Status	Constraints
11.1.0	affected	<11.1.10
11.2.0	affected	<11.2.8
10.1.0	unaffected	-
10.2.0	unaffected	-

Remediation

Vendor solution

Version Minor Version Suggested Solution Cloud NGFW No action needed. PAN-OS 11.2 on PA-7500

11.2.0 through 11.2.7 Upgrade to 11.2.8 or later.

PAN-OS 11.1 on PA-7500

11.1.0 through 11.1.9 Upgrade to 11.1.10 or later. PAN-OS 10.2 on PA-7500 No action needed.PAN-OS 10.1 on PA-7500 No action needed.PAN-OS on devices other than PA-7500 No action needed.All older unsupported PAN-OS versions Upgrade to a supported fixed version.Prisma Access No action needed.

Weaknesses (1)

CWE-312