Pierluigi Paganini February 20, 2025

Palo Alto Networks warns that the vulnerability CVE-2025-0111 is actively exploited with two other flaws to compromise PAN-OS firewalls.

Palo Alto Networks warns that threat actors are chaining the vulnerability CVE-2025-0111 with two other vulnerabilities, tracked as CVE-2025-0108 with CVE-2024-9474, to compromise PAN-OS firewalls.

The vulnerability CVE-2025-0111 is a file read issue in PAN-OS, an authenticated attacker with network access to the management web interface could exploit the flaw to read files that are readable by the “nobody” user.

Palo Alto Networks addressed the flaw CVE-2025-0111 on February 12, 2025. A week later, the cybersecurity vendor updated its bulletin to warn that it is being exploited in the wild. Attackers are chaining them with the CVE-2025-0108 with CVE-2024-9474 issues.

“An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.” reads the updated bulletin published by the vendor.

“Palo Alto Networks has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and unsecured PAN-OS web management interfaces.” 

This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2025-0108 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

The Shadowserver Foundation researchers observed several CVE-2025-0108 attempts since 4 am UTC 2024-02-13 in their honeypots. The experts said that the malicious traffic was originated from 19 IPs seen, attackers attempted to use a recently published PoC exploit code for this vulnerability (with a few creative exceptions).

Cybersecurity firm GreyNoise also confirmed that threat actors attempted to exploit the flaw.

“GreyNoise can confirm active exploitation of CVE-2025-0108.” states GreyNoise. “Organizations relying on PAN-OS firewalls should assume that unpatched devices are being targeted and take immediate steps to secure them. “

The flaw resides in the PAN-OS management web interface. An unauthenticated attacker on the network can couple exploit the vulnerability to bypass authentication and invoke certain PHP scripts.

The company warns that the risk is higher if the management interface is accessible from the internet or an untrusted network, directly or via a dataplane interface with a management profile. The security vendor recommends restricting access to trusted internal IP addresses to minimize the risk of exploitation.

The following versions address the vulnerability:

Cybersecurity firm Assetnote discovered the vulnerability and published a detailed analysis of the issue.

The researchers demonstrated that attackers can exploit the flaw to extract data from vulnerable devices, including firewall configurations.

Assetnote states that CVE-2025-0108 exploits improper URL decoding in PAN-OS firewalls, allowing attackers to bypass authentication. The root cause of the issue is that Nginx and Apache handle encoded paths differently, leading to directory traversal and unauthorized execution of PHP scripts. Since Nginx disables authentication for certain paths, attackers can access the PAN-OS management interface without credentials, resulting in a full authentication bypass.

“we have explored a suspicious (and quite common) architecture where authentication is enforced at a proxy later but then the request is passed through a second layer with different behavior.” reads the report published by Assetnote. “Fundamentally, these sorts of architectures lead to things like header smuggling and path confusion, which can result in many impactful bugs!”

CVE-2024-9474 is a privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

In November 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.

In mid-November, Palo Alto Networks confirmed it had observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces that are exposed to the Internet.

Palo Alto said the zero-day has been exploited to deploy web shells on compromised devices, granting persistent remote access.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Palo Alto)