PT-2025-6473 · Palo Alto Networks · Pan-Os

Adam Kues

·

Published

2025-02-12

·

Updated

2026-03-23

·

CVE-2025-0108

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to the fix released on February 13, 2025
Description An authentication bypass vulnerability exists in the management web interface of Palo Alto Networks PAN-OS. This allows an unauthenticated attacker with network access to bypass authentication and invoke certain PHP scripts. While invoking these scripts does not enable remote code execution, it can negatively impact the integrity and confidentiality of the system. Active exploitation of this vulnerability has been observed, with over 3,500 interfaces exposed and 25 malicious IPs attempting exploitation. The vulnerability is due to a path confusion issue between Nginx and Apache.
Recommendations Update Palo Alto Networks PAN-OS to the latest version released on February 13, 2025, or later. Restrict access to the PAN-OS management interface to only trusted internal IP addresses. If the OpenConfig Plugin is not needed, disable or uninstall it.

Exploit

Fix

RCE

DoS

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-01567
CVE-2025-0108
PANOS_CVE2025_0108
PROFTPCVE_2010_20103

Affected Products

Pan-Os