CVE-2025-2183: falha de média gravidade em Palo Alto Networks GlobalProtect App
GlobalProtect App: Improper Certificate Validation Leads to Privilege Escalation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.1%
An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/U:Amber
CVEs relacionadas — Palo Alto Networks GlobalProtect App
No mesmo produto, das mais perigosas para as menos.
CVE-2024-5921MEDIUMGlobalProtect App: Insufficient Certificate Validation Leads to Privilege EscalationEPSS 1.5%CVE-2021-3057HIGHGlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or GatewayEPSS 1.4%CVE-2020-2033MEDIUMGlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookieEPSS 0.9%CVE-2022-0018MEDIUMGlobalProtect App: Information Exposure Vulnerability When Connecting to GlobalProtect Portal With Single Sign-On EnabledEPSS 0.7%CVE-2026-0298MEDIUMGlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)EPSS 0.7%CVE-2026-0297MEDIUMGlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel HandshakeEPSS 0.6%