← volver
CVE-2025-0120

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

CVSS 7.1 HIGHEPSS 0.1%CWE-250
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.1EPSS 0.1%KEV nãoPoC Nuclei Metasploit Patch referenciado
Ciclo de vida
11 abr 2025Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also successfully exploit a race condition, which makes this vulnerability difficult to exploit.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:C/RE:M/U:Amber

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →