CRITICAL

CVE-2025-0108

Paloaltonetworks Pan Os 2025-02-12 CVSS v3.1

CVSS

9.1

KEV

Description

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access software.

Summary dbcve.org

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. An unauthenticated attacker with network access can bypass authentication and invoke certain PHP scripts, impacting integrity and confidentiality without enabling remote code execution.

Mitigation

Apply the vendor patch for CVE-2025-0108 to all affected PAN-OS installations. Additionally, restrict access to the management web interface to trusted internal IP addresses only.

Proof of Concept

Weakness (CWE)

CWE-306 Missing Authentication

EPSS Score

98.46%

Probability of exploitation in next 30 days

99.9th percentile

References

https://security.paloaltonetworks.com/CVE-2025-0108 Exploit, Vendor Advisory https://github.com/iSee857/CVE-2025-0108-PoC Exploit, Third Party Advisory https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/ Exploit, Press/Media Coverage https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/ Press/Media Coverage, Third Party Advisory https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild Press/Media Coverage, Third Party Advisory https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/ Press/Media Coverage, Third Party Advisory https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/ Press/Media Coverage, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE