CVE-2025-2184
BaseFortify
Publication date: 2025-08-13
Last updated on: 2025-08-13
Assigner: Palo Alto Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| palo_alto_networks | cortex_xdr_broker_vm | 28.0.51 |
| palo_alto_networks | cortex_xdr_broker_vm | 28.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1392 | The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a credential management flaw in Palo Alto Networks Cortex XDR Broker VM where different Broker VM images share identical default credentials for internal services. An attacker with network access to a Broker VM can use these default credentials to access internal services on other Broker VM installations without needing privileges or user interaction. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker with network access to a Broker VM to access internal services on other Broker VM installations using default credentials. This compromises the confidentiality and integrity of the affected systems, potentially exposing sensitive information or allowing unauthorized actions within the internal services. Availability is not impacted. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying Broker VM instances running vulnerable versions (28.0.0 up to but not including 28.0.52) and checking for use of default credentials on internal services. Since the vulnerability involves default credentials shared across Broker VM images, network scanning tools can be used to detect Broker VM services accessible on the network. Specific commands are not provided in the resources, but generally, you can scan for Broker VM services on adjacent network segments and attempt authentication with known default credentials to verify exposure. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to enable automatic upgrades for the Cortex XDR Broker VM to ensure security patches are applied promptly. If automatic upgrades are not currently enabled, users should enable them as soon as possible. There are no known workarounds or alternative mitigations available. [1]