#VU104027 Improper protection of alternate path in Cortex XDR Broker VM - CVE-2025-0113

Vulnerability identifier: #VU104027

Vulnerability risk: High

CVSSv4.0: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0113

CWE-ID: CWE-424

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cortex XDR Broker VM
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Palo Alto Networks, Inc.

Description

The vulnerability allows a remote attacker to gain unauthorized access to VM docker containers.

The vulnerability exists due to an error within the network isolation mechanism. A remote non-authenticated attacker can gain unauthorized access to Docker containers from the host network used by Broker VM and read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cortex XDR Broker VM: 14.3.3 - 25.105.6

---

External links
https://security.paloaltonetworks.com/CVE-2024-0113

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.