Command Injection Flaw in Palo Alto PAN-OS Allows Root-Level Code Execution

A newly disclosed command injection vulnerability (CVE-2025-4230) in Palo Alto Networks PAN-OS software enables authenticated administrators to bypass restrictions and execute arbitrary commands with root privileges.

With a CVSS v4.0 score of 5.7 (Medium severity), this flaw highlights risks in privileged access management for network security appliances.

Vulnerability Overview and Attack Vector

The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78), allowing authenticated admins to exploit the PAN-OS CLI for command injection (CAPEC-248).

Attackers with CLI access can escalate privileges to root, enabling:

• Arbitrary file system modifications
• Unauthorized service disruptions
• Lateral network movement

The attack vector is local (AV:L in CVSS 4.0), requiring high privileges (PR:H) but no user interaction (UI:N).

Despite its medium severity, the impact scores for confidentiality, integrity, and availability are all HIGH (VC:H/VI:H/VA:H).

Affected Products and Mitigation Strategies

The vulnerability impacts PAN-OS versions:

PAN-OS Version	Affected Builds	Fixed Builds
11.2	< 11.2.6	≥ 11.2.6
11.1	< 11.1.10	≥ 11.1.10
10.2	< 10.2.14	≥ 10.2.14
10.1	< 10.1.14-h15	≥ 10.1.14-h15

Cloud NGFW and Prisma Access remain unaffected.

Palo Alto Networks recommends immediate upgrades, as no workarounds exist.

For legacy systems, restricting CLI access to essential personnel reduces exploit likelihood.

Technical Analysis and Industry Response

The flaw’s CVSS-BT score of 8.4 reveals significant baseline threats, with high environmental exploitability (E:U) and amber urgency (U:Amber).

Key technical details include:

• Attack Complexity: Low (AC:L)
• Exploit Maturity: Unreported as of June 2025
• CPE Impact: 11.x and 10.x PAN-OS builds (e.g., cpe:2.3:o:palo_alto_networks:pan-os:11.2.5)

Visa Inc. discovered and reported the vulnerability, triggering coordinated disclosure.

While no active exploitation is documented, the combination of root access and CLI exposure creates a critical risk surface.

Network administrators should audit user privileges and monitor for anomalous CLI activity using PAN-OS audit logs.

This incident underscores the need for rigorous access controls in network security infrastructure.

As threat actors increasingly target edge devices, maintaining patch discipline and minimizing administrative attack surfaces remain paramount.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates