Palo Alto Networks warns that CVE-2025-0111 flaw is actively exploited in attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-9474 | Root Privilege Escalation via Command Injection in Palo Alto Networks PAN-OS CVE-2024-9474 is an OS command injection flaw (CWE-78) in the Palo Alto Networks PAN-OS management web interface that allows a PAN-OS administrator to perform actions on the firewall with root privileges. It is triggered by an authenticated administrator through the management interface, and it becomes far more serious when chained with the separately disclosed CVE-2024-0012 management-interface authentication bypass, which hands unauthenticated attackers initial access before they escalate to root. A successful attacker gains root-level control of the device, enough to alter configurations, harvest credentials, and pivot into connected networks. Only PAN-OS deployments are affected — Palo Alto Networks states Cloud NGFW and Prisma Access are not impacted. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-11-18 with known ransomware use, reporting describes over 2,000 PAN-OS devices compromised in an ongoing campaign, and public PoC/exploit code is available. Do: Upgrade affected PAN-OS systems to the patched releases identified in the Palo Alto Networks security advisory, and also remediate CVE-2024-0012, which attackers are chaining with this flaw. Until patched, ensure the management interface is not exposed to untrusted networks including the internet, per CISA's required action. Because successful attackers obtain root access, review management and configuration audit logs for unexpected activity and rotate management credentials on any device showing signs of compromise. | 6.9 | 95% | KEV ransomware PoC ×2 |
| large≈tens of thousands of internet-exposed PAN-OS management interfaces, with 2,000+ devices confirmed compromised | |
| CVE-2025-0108 +1 in the same advisory: …0111 | Authentication Bypass in Palo Alto Networks PAN-OS Management Interface CVE-2025-0108 is a missing-authentication flaw (CWE-306) in the PAN-OS management web interface of Palo Alto Networks firewalls that lets an unauthenticated attacker with network access to that interface bypass login and invoke certain PHP scripts, reportedly via path-confusion tricks in the web server stack. Invoking the scripts does not yield remote code execution, but it can compromise the confidentiality and integrity of PAN-OS, such as by reading or modifying management-plane information. Any PAN-OS firewall whose management web interface is reachable by an attacker — for example, exposed to the internet or reachable from a compromised internal network — is affected, while Cloud NGFW and Prisma Access are not. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-18, a public proof-of-concept is available, EPSS puts the 30-day exploitation probability at 98.5%, and headlines report attackers chaining this bug with other PAN-OS flaws to breach firewalls. Do: Upgrade PAN-OS to a fixed release per the Palo Alto Networks advisory (security.paloaltonetworks.com/CVE-2025-0108), since the vendor has patched the flaw. Until patched, restrict management web interface access to trusted internal IP addresses or management-only network zones as recommended in the vendor's hardening guidance. Check management-interface logs for unauthenticated requests to PHP scripts and for signs of chaining with other recently exploited PAN-OS vulnerabilities. | 8.8 group max | 98% | KEV PoC ×3 |
| large≈ tens of thousands of internet-exposed PAN-OS management interfaces (subset of a much larger firewall install base) |
Full article717 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 20, 2025
Palo Alto Networks warns that the vulnerability CVE-2025-0111 is actively exploited with two other flaws to compromise PAN-OS firewalls.
Palo Alto Networks warns that threat actors are chaining the vulnerability CVE-2025-0111 with two other vulnerabilities, tracked as CVE-2025-0108 with CVE-2024-9474, to compromise PAN-OS firewalls.
The vulnerability CVE-2025-0111 is a file read issue in PAN-OS, an authenticated attacker with network access to the management web interface could exploit the flaw to read files that are readable by the “nobody” user.
Palo Alto Networks addressed the flaw CVE-2025-0111 on February 12, 2025. A week later, the cybersecurity vendor updated its bulletin to warn that it is being exploited in the wild. Attackers are chaining them with the CVE-2025-0108 with CVE-2024-9474 issues.
“An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.” reads the updated bulletin published by the vendor.
“Palo Alto Networks has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and unsecured PAN-OS web management interfaces.”
This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2025-0108 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
The Shadowserver Foundation researchers observed several CVE-2025-0108 attempts since 4 am UTC 2024-02-13 in their honeypots. The experts said that the malicious traffic was originated from 19 IPs seen, attackers attempted to use a recently published PoC exploit code for this vulnerability (with a few creative exceptions).
Cybersecurity firm GreyNoise also confirmed that threat actors attempted to exploit the flaw.
“GreyNoise can confirm active exploitation of CVE-2025-0108.” states GreyNoise. “Organizations relying on PAN-OS firewalls should assume that unpatched devices are being targeted and take immediate steps to secure them. “
The flaw resides in the PAN-OS management web interface. An unauthenticated attacker on the network can couple exploit the vulnerability to bypass authentication and invoke certain PHP scripts.
The company warns that the risk is higher if the management interface is accessible from the internet or an untrusted network, directly or via a dataplane interface with a management profile. The security vendor recommends restricting access to trusted internal IP addresses to minimize the risk of exploitation.
The following versions address the vulnerability:
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 11.2 | < 11.2.4-h4 | >= 11.2.4-h4 |
| PAN-OS 11.1 | < 11.1.6-h1 | >= 11.1.6-h1 |
| PAN-OS 10.2 | < 10.2.13-h3 | >= 10.2.13-h3 |
| PAN-OS 10.1 | < 10.1.14-h9 | >= 10.1.14-h9 |
| Prisma Access | None | All |
Cybersecurity firm Assetnote discovered the vulnerability and published a detailed analysis of the issue.
The researchers demonstrated that attackers can exploit the flaw to extract data from vulnerable devices, including firewall configurations.
Assetnote states that CVE-2025-0108 exploits improper URL decoding in PAN-OS firewalls, allowing attackers to bypass authentication. The root cause of the issue is that Nginx and Apache handle encoded paths differently, leading to directory traversal and unauthorized execution of PHP scripts. Since Nginx disables authentication for certain paths, attackers can access the PAN-OS management interface without credentials, resulting in a full authentication bypass.
“we have explored a suspicious (and quite common) architecture where authentication is enforced at a proxy later but then the request is passed through a second layer with different behavior.” reads the report published by Assetnote. “Fundamentally, these sorts of architectures lead to things like header smuggling and path confusion, which can result in many impactful bugs!”
CVE-2024-9474 is a privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
In November 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
In mid-November, Palo Alto Networks confirmed it had observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces that are exposed to the Internet.
Palo Alto said the zero-day has been exploited to deploy web shells on compromised devices, granting persistent remote access.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Palo Alto)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/174409/hacking/palo-alto-networks-cve-2025-0111-actively-exploited.html