Actively exploited · Published Feb 12, 2025 · Assigned by palo_alto
CVE-2025-0111PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
High 7.1 Exploited
In plain English
A high-severity security flaw in Cloud NGFW from Palo Alto Networks. Attackers are actively exploiting it in the wild (listed by CISA on February 20, 2025). The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 13, 2025.
Official description
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Cloud NGFW | see references |
| Palo Alto Networks | PAN-OS | 10.1.0 – before 10.1.14-h910.2.0 – before 10.2.7-h2411.1.0 – before 11.1.6-h111.2.0 – before 11.2.4-h4 |
| Palo Alto Networks | Prisma Access | see references |
Weakness: CWE-73 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red
References
- https://security.paloaltonetworks.com/CVE-2025-0111 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0111 government-resource