No items found.

February 25, 2025

Minutes Read

Palo Alto PAN-OS Bug Severity Upgraded, Exploited in Wild

Advisory

February 25, 2025

Minutes Read

Palo Alto PAN-OS Bug Severity Upgraded, Exploited in Wild

This is some text inside of a div block.

Minutes Read

Kudelski Security Team

Find out more

table of contents

Share on

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Summary

Earlier this month we published an advisory about CVE-2025-0108, a vulnerability which allows an unauthenticated attacker to access the web management user interface of Palo Alto Networks’ PAN-OS and invoke certain scripts. Along with the aforementioned bug nine others were disclosed, all less severe as they offered less utility to potential attackers. Since the original time of writing, proof-of-concept exploit code for CVE-2025-0108 has been publicly released and used in the wild. Additionally, one of the nine less-severe bugs included in the PAN disclosure, CVE-2025-0111, has been upgraded from Medium severity/Moderate urgency to High severity/Highest urgency. It allows an authenticated attacker with access to the web management UI to read les on the PAN-OS lesystem which are readable by the nobody user, and Palo Alto has warned that CVE-2025-0111 is being chained with CVE-2025-0108 and CVE-2024-9474: to exactly what end is still unknown, but prior attacks involving CVE-2024-9474 and a vulnerability similar to CVE-2025-0108 resulted in the extraction of rewall con gurations and deployment of malware on compromised appliances. CISA has added CVE2025-0111 to its Known Exploited Vulnerabilities (KEV) catalog.

Affected Systems and/or Applications

Versions	Affected	Unaffected
Cloud NGFW	None	All
PAN-OS 11.2	< 11.2.4-h4 < 11.2.5	>= 11.2.4-h4 >= 11.2.5
PAN-OS 11.1	< 11.1.2-h18 < 11.1.4-h13 < 11.1.6-h1	>= 11.1.2-h18 >= 11.1.4-h13 >= 11.1.6-h1
PAN-OS 10.2	< 10.2.7-h24 < 10.2.8-h21 < 10.2.9-h21 < 10.2.10-h14 < 10.2.11-h12 < 10.2.12-h6 < 10.2.13-h3	>= 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.10-h14 >= 10.2.11-h12 >= 10.2.12-h6 >= 10.2.13-h3
PAN-OS 10.1	< 10.1.14-h9	>= 10.1.14-h9
Prisma Access	None	All

Mitigation/Solution

As with CVE-2025-0108, Palo Alto recommends restricting access to the management UI from external IPs, which greatly reduces the overall risk of exploitation, as well as patching to a PAN-OS version listed below. Additionally, customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510000 and 510001.

Version	Minor Version	Suggested Solution
PAN-OS 10.1	10.1.0 through 10.1.14	Upgrade to 10.1.14-h9 or later
PAN-OS 10.2	10.2.0 through 10.2.13	Upgrade to 10.2.13-h3 or later
	10.2.7	Upgrade to 10.2.7-h24 or 10.2.13-h3 or later
	10.2.8	Upgrade to 10.2.8-h21 or 10.2.13-h3 or later
	10.2.9	Upgrade to 10.2.9-h21 or 10.2.13-h3 or later
	10.2.10	Upgrade to 10.2.10-h14 or 10.2.13-h3 or later
	10.2.11	Upgrade to 10.2.11-h12 or 10.2.13-h3 or later
	10.2.12	Upgrade to 10.2.12-h6 or 10.2.13-h3 or late
PAN-OS 11.0 (EoL)		Upgrade to a supported fixed version
PAN-OS 11.1	11.1.0 through 11.1.6	Upgrade to 11.1.6-h1 or later
	11.1.2	Upgrade to 11.1.2-h18 or 11.1.6-h1 or later
	11.1.4	Upgrade to 11.1.4-h13 or 11.1.6-h1 or later
PAN-OS 11.2	11.2.0 through 11.2.4	Upgrade to 11.2.5 or later
	11.2.4	Upgrade to 11.2.4-h4 or 11.2.5 or later

Furthermore, Palo Alto offers detection of internet-facing devices through their support portal:

To find any assets that require remediation action, visit the Assets section of the Customer SupportPortal at https://support.paloaltonetworks.com (Products → Assets → All Assets → RemediationRequired).
Review the list of your devices that we discovered in our scans to have an internet-facingmanagement interface and that we tagged with ‘PAN-SA-2024-0015’ and a last seen timestamp (inUTC). If you do not see any such devices listed, then our scan did not fi nd any devices on youraccount to have an internet-facing management interface within the past three days.

What the Cyber Fusion Center is Doing

The CFC will continue to monitor the situation and send an advisory update if needed. Clients subscribed to our vulnerability scan services will receive relevant results if critical vulnerabilities are found within the scope of the scans as soon as a relevant plugin is made available by the scan provider.