CVE-2025-4229: PAN-OS SD-WAN Information Disclosure Flaw

CVE-2025-4229 Overview

CVE-2025-4229 is an information disclosure vulnerability in the Software-Defined Wide Area Network (SD-WAN) feature of Palo Alto Networks PAN-OS® software. The flaw enables an unauthorized user to view unencrypted data transmitted from the firewall through the SD-WAN interface. Successful exploitation requires the attacker to intercept packets sent from the firewall, placing the attack vector on adjacent or in-path network positions.

Cloud NGFW and Prisma® Access deployments are not affected. The weakness is categorized under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere.

Critical Impact
An attacker positioned to intercept SD-WAN traffic can read unencrypted data leaving the firewall, exposing potentially sensitive operational information.

Affected Products

Palo Alto Networks PAN-OS software with the SD-WAN feature enabled
On-premises Next-Generation Firewalls running affected PAN-OS versions
Deployments routing traffic through SD-WAN interfaces

Discovery Timeline

2025-06-13 - CVE-2025-4229 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-4229

Vulnerability Analysis

The vulnerability resides in how PAN-OS handles data egressing through the SD-WAN interface. Traffic that should be protected during transit is sent without encryption under specific conditions. An attacker capable of capturing packets in the network path between the firewall and remote SD-WAN endpoints can read the plaintext content.

The attack requires network-level packet interception capability and a degree of user interaction in the affected environment. The vulnerability does not grant code execution, persistence, or integrity impact. The scope is limited to confidentiality of data traversing the SD-WAN interface.

The EPSS probability is 0.385%, indicating low predicted likelihood of mass exploitation. However, targeted attacks against organizations using SD-WAN over untrusted transport networks remain a credible risk.

Root Cause

The root cause is improper handling of encryption for outbound SD-WAN traffic, mapping to [CWE-497]. Data that the operator may reasonably expect to be encrypted is transmitted in cleartext through the SD-WAN interface. This exposes sensitive system or session information to any party with packet capture access on the transit path.

Attack Vector

The attack vector is network-based and requires the adversary to occupy a position capable of observing firewall egress traffic. Possible vantage points include compromised upstream routers, ISP-level interception, malicious insiders with span port access, or rogue devices on shared transit segments. No authentication to the firewall itself is required.

Exploitation involves passive packet capture rather than active manipulation. The attacker reconstructs plaintext content from intercepted SD-WAN packets. Because the activity is passive, the firewall produces no direct indication of compromise. See the Palo Alto Networks CVE-2025-4229 Advisory for vendor-specific technical context.

Detection Methods for CVE-2025-4229

Indicators of Compromise

Unexpected plaintext PAN-OS management or telemetry data observed in packet captures on SD-WAN transit links
Unauthorized SPAN, TAP, or mirror port configurations on switches adjacent to firewall SD-WAN interfaces
Anomalous ARP, routing, or BGP changes that could place an attacker in-path between SD-WAN peers

Detection Strategies

Perform periodic packet captures on SD-WAN egress paths and inspect for unencrypted PAN-OS metadata or session content
Compare observed PAN-OS versions against the vendor advisory to identify exposed appliances
Correlate firewall configuration changes that enable or modify SD-WAN policies with traffic-flow telemetry

Monitoring Recommendations

Centralize PAN-OS configuration and audit logs for review of SD-WAN policy modifications
Monitor network infrastructure for unauthorized port mirroring, MAC address anomalies, and route hijacking attempts
Alert on PAN-OS versions in the environment that match the advisory's affected ranges until patched

How to Mitigate CVE-2025-4229

Immediate Actions Required

Identify all PAN-OS firewalls with the SD-WAN feature enabled and document their software versions
Apply the fixed PAN-OS releases listed in the vendor advisory as soon as change windows permit
Restrict physical and logical access to network segments carrying SD-WAN traffic between firewall peers

Patch Information

Palo Alto Networks has published fixed PAN-OS versions in the Palo Alto Networks CVE-2025-4229 Advisory. Administrators should consult the advisory for the exact PAN-OS versions resolving the issue and follow the vendor's upgrade guidance for SD-WAN-enabled appliances. Cloud NGFW and Prisma® Access customers require no action.

Workarounds

Tunnel SD-WAN transit traffic over IPsec or another encrypted overlay until patches are applied
Limit SD-WAN deployment to trusted transport networks where packet interception is infeasible
Disable the SD-WAN feature on appliances where it is not operationally required

bash

# Example: verify PAN-OS version and SD-WAN status via CLI
show system info | match sw-version
show sdwan connection all