GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement (Palo Alto Networks GlobalProtect App)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.16 % · percentile 6 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- palo_alto
- NVD status
- Analyzed
Description
An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtectâ„¢ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel. An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one minute.
Weaknesses (CWE)
- CWE-319 — Cleartext Transmission of Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | LOW 1.0 | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Green | palo_alto |
| CVSS 4.0 | LOW 1.0 | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Green | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | LOW 3.5 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-18244
- GCVE · GCVE-0-2025-4227
CERT-FR advisories
- CERTFR-2025-AVI-0505 — Multiples vulnérabilités dans les produits Palo Alto Networks · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*≥ 6.0.0 < 6.2.8cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*≥ 6.0.0 < 6.2.8cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*≥ 6.3.0 < 6.3.3cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*≥ 6.3.0 < 6.3.3
Affected products
| Product | Versions |
|---|---|
| Palo Alto Networks · GlobalProtect App | affected 6.3.0 < 6.3.2-566 ; affected 6.2.0 < 6.2.8-h2 ; affected 6.1.0 ; affected 6.0.0 |
| Palo Alto Networks · GlobalProtect App | unaffected All < 11.2.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |