CVE-2025-0116: Palo Alto PAN-OS DoS Vulnerability

CVE-2025-0116 Overview

CVE-2025-0116 is a Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software. An unauthenticated adjacent attacker can send a specially crafted Link Layer Discovery Protocol (LLDP) frame that causes the firewall to unexpectedly reboot. Repeated exploitation attempts force the firewall into maintenance mode, requiring manual recovery.

The issue does not affect Cloud NGFWs or Prisma Access software. The vulnerability is tracked under [CWE-754] (Improper Check for Unusual or Exceptional Conditions) and requires adjacent network access to the target firewall.

Critical Impact
A single crafted LLDP frame reboots the firewall; repeated frames drop the device into maintenance mode, disrupting network availability and requiring manual intervention.

Affected Products

Palo Alto Networks PAN-OS software (firewall appliances processing LLDP)
Physical and virtual PAN-OS firewalls with LLDP enabled on adjacent-network interfaces
Not affected: Cloud NGFW and Prisma Access

Discovery Timeline

2025-03-12 - CVE-2025-0116 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0116

Vulnerability Analysis

The vulnerability resides in the LLDP frame processing logic of PAN-OS. LLDP is a Layer 2 protocol used by network devices to advertise identity, capabilities, and neighbors on a local segment. Because LLDP operates on the local link, only an attacker on the same broadcast domain as the firewall interface can deliver a malicious frame.

When PAN-OS parses a malformed LLDP TLV (Type-Length-Value) structure, it fails to properly handle an exceptional condition. This causes the firewall process to crash, triggering an unexpected system reboot. Sustained crafted frames prevent the device from completing normal boot, transitioning it into maintenance mode.

The result is a loss of firewall availability. Because PAN-OS firewalls typically enforce perimeter or segmentation controls, a reboot loop disrupts the traffic paths that depend on the affected device.

Root Cause

The root cause is improper handling of unusual or exceptional conditions [CWE-754] in the LLDP parser. Malformed input reaches code paths that lack defensive validation, and the resulting fault propagates to a full system reboot rather than being contained within the LLDP process.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same Layer 2 segment as an LLDP-enabled firewall interface. No authentication is required. The attacker crafts an LLDP Ethernet frame (EtherType 0x88CC) containing the malformed TLV structure and transmits it toward the firewall. Repeated transmission drives the firewall into maintenance mode.

For exploitation specifics, refer to the Palo Alto Networks CVE-2025-0116 Advisory.

Detection Methods for CVE-2025-0116

Indicators of Compromise

Unexpected firewall reboots correlated with LLDP traffic on adjacent segments
PAN-OS system logs showing dataplane or management-plane crash events near an LLDP receive event
Firewall entering maintenance mode without a scheduled change or operator action
Anomalous LLDP frame volume or malformed LLDP TLVs observed on span/tap ports adjacent to the firewall

Detection Strategies

Monitor PAN-OS system.log for reboot events and unexpected transitions to maintenance mode.
Inspect adjacent switch ports for LLDP frames with malformed or oversized TLVs using packet capture tools such as Wireshark.
Alert on repeated LLDP frames from unexpected MAC addresses on interfaces where only known neighbors should appear.

Monitoring Recommendations

Forward PAN-OS syslog and health telemetry to a centralized SIEM and alert on reboot or maintenance-mode events.
Baseline expected LLDP neighbors per interface and alert on new or unknown LLDP sources.
Track availability metrics for firewall pairs and correlate failovers with Layer 2 events on adjacent switches.

How to Mitigate CVE-2025-0116

Immediate Actions Required

Apply the fixed PAN-OS version listed in the Palo Alto Networks CVE-2025-0116 Advisory as soon as maintenance windows allow.
Disable LLDP on firewall interfaces where it is not required for operations or monitoring.
Restrict Layer 2 access to firewall interfaces by tightening physical port security and 802.1X on adjacent switches.
Ensure high-availability (HA) pairs are configured so that a rebooting device fails over without traffic loss.

Patch Information

Palo Alto Networks has published fixed versions in its security advisory. Consult the Palo Alto Networks CVE-2025-0116 Advisory for the specific PAN-OS releases that remediate the LLDP parser flaw and follow the vendor's guidance on upgrade order for HA pairs.

Workarounds

Disable LLDP profiles on affected interfaces using the PAN-OS web interface or CLI until the patch is applied.
Segment management and data interfaces so that untrusted hosts cannot reach the same Layer 2 domain as the firewall.
Enforce switchport access control lists and disable unused ports on switches adjacent to the firewall to limit who can inject LLDP frames.

bash

# Example: disable LLDP on a PAN-OS interface via CLI
configure
set network lldp interface ethernet1/1 enable no
commit