Summary:

Palo Alto Networks has disclosed a reflected cross-site scripting (XSS) vulnerability, identified as CVE-2025-0133, affecting the GlobalProtect gateway and portal features of its PAN-OS software. This flaw allows execution of malicious JavaScript in the browsers of authenticated Captive Portal users when they click on specially crafted links. While the default configuration poses a low risk (CVSS Base Score 2.0), the severity increases to medium (CVSS 5.5) when the Clientless VPN feature is enabled. 

Security Impact: Palo Alto Networks has disclosed a reflected cross-site scripting (XSS) vulnerability, identified as CVE-2025-0133, affecting the GlobalProtect gateway and portal features of its PAN-OS software.

Risks:

The primary risk associated with CVE-2025-0133 is credential theft through phishing attacks. Attackers can craft convincing phishing links that appear to originate from the legitimate GlobalProtect portal, tricking users into divulging sensitive information. The vulnerability is particularly concerning for organizations utilizing the Clientless VPN feature, as it elevates the attack’s severity. Although no malicious exploitation has been reported yet, the availability of proof-of-concept exploit code increases the urgency for mitigation. 

Affected Versions:

The following PAN-OS versions are affected by CVE-2025-0133:

Summary:

Cloud NGFW: All versions

PAN-OS 11.2: Versions prior to 11.2.7

PAN-OS 11.1: Versions prior to 11.1.11

PAN-OS 10.2: Versions prior to 10.2.17

PAN-OS 10.1: All versions

It’s important to note that Prisma Access is unaffected by this vulnerability. 

Remediation:

Palo Alto Networks recommends the following remediation steps:

  • Upgrade PAN-OS:

    • PAN-OS 11.2: Upgrade to version 11.2.7 or later (expected June 2025).

    • PAN-OS 11.1: Upgrade to version 11.1.11 or later (expected July 2025).

    • PAN-OS 10.2: Upgrade to version 10.2.17 or later (expected August 2025).

    • PAN-OS 10.1: Upgrade to version 10.2.17 or later (expected August 2025).

  • Enable Threat Prevention:

    • For customers with a Threat Prevention subscription, enable Threat IDs 510003 and 510004, introduced in Applications and Threats content version 8970.

  • Disable Clientless VPN:

    • Consider disabling the Clientless VPN feature to reduce the attack surface.

Implementing these measures will help mitigate the risk associated with CVE-2025-0133. 

Conclusion:

CVE-2025-0133 presents a significant security concern for organizations using affected versions of PAN-OS, especially those with the Clientless VPN feature enabled. The vulnerability’s potential for credential theft through phishing attacks necessitates prompt action. Organizations should prioritize upgrading to the recommended PAN-OS versions, enable relevant Threat Prevention measures, and educate users to recognize and avoid phishing attempts. Proactive mitigation is essential to safeguard against potential exploitation.

Reference:

  • Palo Alto Networks Security Advisory: CVE-2025-0133

  • Cyber Security News Article on CVE-2025-0133