CVE-2025-0111

CVE-2025-0111 is an authenticated arbitrary file read vulnerability in Palo Alto Networks PAN-OS, reachable through the firewall's management web interface (CWE-73/CWE-610). An attacker who already has low-privileged credentials and network access to the management interface can craft requests to read files on the PAN-OS filesystem that are readable by the "nobody" user, potentially exposing configuration and other sensitive data. Only appliances running PAN-OS with a reachable management interface are affected; Palo Alto Networks states the flaw does not affect Cloud NGFW or Prisma Access. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-02-20, and the vendor has warned that it is being actively exploited, with headlines indicating attackers are chaining it with other PAN-OS flaws (such as the separately patched CVE-2025-0108 authentication bypass). No public proof-of-concept exploit is known, and EPSS estimates a 2.0% chance of exploitation in the next 30 days (80th percentile).

What to do: Apply the PAN-OS patch identified in the Palo Alto Networks security advisory for CVE-2025-0111; since this is a KEV entry (added 2025-02-20), federal agencies must remediate per vendor instructions or discontinue use by the required deadline. As an interim mitigation, restrict access to the management web interface to trusted internal IP addresses per the vendor's best-practice deployment guidance, and verify no management interface is exposed to the internet. Hunt management-interface logs for anomalous authenticated activity, as attackers have been observed chaining this flaw with other PAN-OS vulnerabilities.