This vulnerability arises from the Prisma SD‑WAN ION appliance not properly validating TLS certificates when communicating with its controller. The weakness, identified as CWE‑295, allows a man‑in‑the‑middle attacker to impersonate the legitimate controller. An attacker could intercept, alter, or forge management traffic, exposing confidential configuration data or undermining device integrity.

The CVE affects Palo Alto Networks Prisma SD‑WAN ION appliances. Vulnerable versions are 6.5.1 through 6.5.3, 6.4.1 through 6.4.3, and 6.3.1 through 6.3.6; the vendor recommends upgrading to 6.5.3‑b15 or later, 6.4.3‑b8 or later, and 6.3.6‑b10 or later respectively. Versions 6.1 and 5.6 are unaffected.

The CVSS base score of 5.2 indicates moderate risk. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. Nevertheless, because the flaw permits a man‑in‑the‑middle attack, any attacker who can position themselves on the path between the device and its controller—by manipulating DNS, routing, or network links—might be able to mount an exploitation. Organizations should therefore prioritize patching to eliminate the opportunity for such attacks.