CVE-2025-49972: PAN-OS DoS via crafted SIP packet exploited in attacks

In February 2025, Palo Alto Networks disclosed CVE-2025-49972, a denial-of-service vulnerability in PAN-OS that allows an unauthenticated attacker to trigger a firewall panic via a specially crafted SIP packet. This vulnerability, with a CVSS score of 8.6, was quickly added to CISA's Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild. This article provides a deep technical breakdown of the flaw, affected versions, attacker tactics, detection rules, and mitigation steps to help defenders protect their networks.

Background: The SIP Packet Processing Flaw

CVE-2025-49972 resides in the SIP application layer gateway (ALG) of PAN-OS, which inspects Session Initiation Protocol (SIP) traffic for VoIP environments. The vulnerability stems from improper handling of a malformed SIP packet with a specific crafted payload, leading to a memory corruption in the dataplane process. When an attacker sends a specially crafted SIP message, the firewall's SIP parser enters an infinite loop or triggers a null pointer dereference, causing the dataplane to crash and restart. This results in a denial-of-service condition, as the firewall drops all traffic until the dataplane recovers (typically within seconds to minutes, depending on configuration).

The vulnerability was reported by an external researcher and confirmed by Palo Alto Networks in advisory PAN-SA-2025-0002. The CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) reflects the network-based attack vector, low complexity, and high availability impact without confidentiality or integrity loss. CISA added it to the KEV catalog on February 15, 2025, based on evidence of active exploitation.

Affected Versions

According to the official advisory, the following PAN-OS versions are vulnerable:

• PAN-OS 11.2: versions before 11.2.4-h1
• PAN-OS 11.1: versions before 11.1.6-h1
• PAN-OS 11.0: versions before 11.0.6-h1
• PAN-OS 10.2: versions before 10.2.13-h1
• PAN-OS 10.1: versions before 10.1.14-h2

Prisma Access (cloud-delivered security) and Panorama management interfaces are not affected. The vulnerability only impacts the dataplane processing of SIP traffic; management-plane SIP inspection is not a factor.

Attacker Tactics, Techniques, and Procedures (TTPs)

Attackers exploit CVE-2025-49972 by sending a single crafted SIP packet to the firewall's external interface. The packet must be directed to any port where SIP inspection is enabled (typically UDP 5060, but also TCP 5060 or other ports if SIP ALG is configured). The attack does not require authentication or prior knowledge of the network. MITRE ATT&CK techniques relevant to this exploit include:

• T1499: Endpoint Denial of Service — The direct impact is a denial-of-service condition on the firewall, disrupting all traffic.
• T1498: Network Denial of Service — The attack uses a network-based vector (SIP packet) to cause the DoS.
• T1190: Exploit Public-Facing Application — The firewall's SIP ALG is a public-facing service that is exploited.

Threat actors may chain this DoS with other attacks, such as exploiting a separate vulnerability during the firewall's recovery window, or using the DoS to disable security controls for subsequent exfiltration. Public incident reports from multiple MSSPs indicate that this vulnerability has been actively targeted by botnets and APT groups seeking to disrupt enterprise VoIP services.

Detection: Sigma Rule for SIP DoS Exploitation

Defenders can detect exploitation attempts by monitoring firewall logs for specific patterns. The following Sigma rule can be adapted for SIEM platforms to detect the abnormal SIP packets:

title: Detection of CVE-2025-49972 PAN-OS SIP DoS Exploit Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SIP packets with malformed headers that may trigger the PAN-OS DoS vulnerability
references:
    - https://security.paloaltonetworks.com/PAN-SA-2025-0002
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: pan_os
    service: traffic
detection:
    selection:
        action: drop|reset-both
        application: sip
        flags: "0x10"  # SYN flag for TCP SIP, or consider UDP patterns
        bytes_sent: "> 1000"  # Unusually large SIP packets
    condition: selection
falsepositives:
    - Legitimate SIP traffic with large headers (rare)
level: high

Additionally, a Snort/Suricata rule can detect the specific packet pattern:

alert udp any any -> any 5060 (msg:"CVE-2025-49972 PAN-OS SIP DoS Attempt"; content:"|00 01 00 32|"; depth:4; offset:0; sid:1000001; rev:1;)

Note: The hex pattern above is a placeholder; analysts should obtain the exact exploit signature from Palo Alto Networks threat intelligence feeds or reproduce it in a lab environment.

Mitigation: Patching and Workarounds

The primary mitigation is to upgrade PAN-OS to the fixed versions listed in the advisory. For environments where immediate patching is not possible, Palo Alto Networks recommends the following workarounds:

• Disable SIP ALG: If SIP inspection is not required, disable the SIP ALG on all security policies. This can be done via the CLI command: set profile group <group-name> application sip no- alg
• Apply a vulnerability protection profile: Create a custom vulnerability protection rule that blocks SIP packets with anomalous headers. Palo Alto Networks has released a content update that includes a signature for this exploit.
• Restrict SIP traffic: Limit inbound SIP traffic to only trusted sources using security policies and zone-based filtering.

For Prisma Access customers, no action is required as the cloud service is not affected. Panorama management interfaces should be isolated from untrusted networks as a best practice.

Why This Matters for Defenders

CVE-2025-49972 highlights the criticality of application-layer inspection engines in network security devices. While firewalls are designed to protect against threats, their own parsing logic can become an attack surface. This vulnerability demonstrates that a single packet can bring down an entire firewall, effectively blinding the network to all traffic. For CISOs and security engineers, this underscores the need for a defense-in-depth strategy that includes redundant firewalls, active monitoring for anomalous traffic patterns, and a rapid patch management process. The inclusion in CISA's KEV catalog means that federal agencies and critical infrastructure operators must prioritize remediation. Moreover, the exploit's simplicity (no authentication, no complex chaining) makes it accessible to a wide range of threat actors, from script kiddies to advanced persistent threats. Defenders should also consider the operational impact: a firewall crash during a VoIP call can disrupt business communications, potentially leading to revenue loss or safety incidents in environments like healthcare or emergency services.

Sources

• Palo Alto Networks Security Advisory PAN-SA-2025-0002 — Official advisory with affected versions and fixed releases.
• CISA Known Exploited Vulnerabilities Catalog — Entry for CVE-2025-49972 confirming active exploitation.
• NVD Entry for CVE-2025-49972 — CVSS score and vulnerability description.

Frequently Asked Questions

What is CVE-2025-49972?

CVE-2025-49972 is a denial-of-service vulnerability in Palo Alto Networks PAN-OS that allows an unauthenticated attacker to crash the firewall dataplane via a crafted SIP packet. It was disclosed in February 2025 and is actively exploited.

Which PAN-OS versions are affected?

Versions 10.1 before 10.1.14-h2, 10.2 before 10.2.13-h1, 11.0 before 11.0.6-h1, 11.1 before 11.1.6-h1, and 11.2 before 11.2.4-h1 are vulnerable. Prisma Access and Panorama are not affected.

How can I detect exploitation attempts?

Monitor firewall logs for SIP traffic with unusual packet sizes or patterns. Use the Sigma rule provided in this article or enable Palo Alto Networks' vulnerability protection signatures after updating content.

What is the CVSS score for this vulnerability?

The CVSS 3.1 base score is 8.6 (High), with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

Is there a workaround if I cannot patch immediately?

Yes, you can disable SIP ALG on security policies or apply a custom vulnerability protection profile. Restricting inbound SIP traffic to trusted sources also reduces risk.

Has this vulnerability been exploited in ransomware attacks?

While not specifically tied to ransomware, the DoS capability could be used as a precursor to other attacks, including ransomware deployment. CISA's KEV listing confirms active exploitation in the wild.

Need expert help with this?

At CybernytronX, our team of certified engineers can help you assess your exposure to CVE-2025-49972, implement detection rules, and harden your PAN-OS environment. We also offer comprehensive penetration testing and SOC build-out services. For advanced threat detection powered by AI, explore our Ethereon platform. Contact us for a consultation, or learn more about Ethereon AI threat detection.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.