CVE-2022-0028
Paloaltonetworks Pan-Os 8.1.0 – 8.1.23
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2022-0028 is a high-severity Network Amplification (CWE-406) vulnerability in Paloaltonetworks Pan-Os. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 15% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A PAN-OS URL filtering policy misconfiguration affects PA-Series hardware, VM-Series virtual, and CN-Series container firewalls running PAN-OS. The flaw enables a network-based attacker to trigger reflected and amplified TCP denial-of-service attacks that appear to originate from the firewall itself when a URL filtering profile containing one or more blocked categories is assigned to a source zone with an external-facing interface. This configuration is described as atypical and likely unintended. The issue does not affect Panorama appliances, Cloud NGFW, or Prisma Access customers.
An unauthenticated network attacker can exploit the condition to direct amplified TCP traffic toward an arbitrary target, implicating the firewall as the attack source and thereby obfuscating the true origin. The attack has no impact on the confidentiality, integrity, or availability of the firewall itself.
Palo Alto Networks states that software fixes were scheduled for release no later than the week of 15 August 2022. The vendor has already resolved the issue for all Cloud NGFW and Prisma Access deployments, requiring no further customer action in those environments. The vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog.
EPSS scores have remained low, with a current value of 0.0468 and a peak of 0.0481.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15249
Vulnerability Data
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall…
more
against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.
- CWE(s)
- KEV Date Added
- 22 August 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limits attacker success in sustaining network amplification DoS against the primary by providing a ready alternate processing capability.
Provides continuity when primary telecom is disrupted by insufficient control of network message volume or amplification.
Network-volume amplification against one channel can be bypassed via the pre-established alternate path.
Implements network message volume controls to block amplification DoS vectors.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging provides visibility into high-volume traffic but does not itself limit or control it.
Monitoring activities can detect anomalous traffic volumes, yet detection alone does not enforce control.
Network security controls include traffic filtering and rate-limiting that prevent amplification attacks.
Capacity management directly limits excessive outbound traffic that an actor could otherwise trigger.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-406, a class-level weakness, and none of its children carries one either.