PT-2025-6473 · Palo Alto Networks · Pan-Os
Adam Kues
·
Published
2025-02-12
·
Updated
2026-03-29
·
CVE-2025-0108
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Palo Alto Networks PAN-OS versions prior to the fix released on February 13, 2025
Description
An authentication bypass vulnerability exists in Palo Alto Networks PAN-OS, allowing an unauthenticated attacker with network access to the management web interface to bypass authentication and invoke certain PHP scripts. While invoking these scripts does not enable remote code execution, it can negatively impact the integrity and confidentiality of PAN-OS. This vulnerability is actively exploited in the wild, with over 25 malicious IPs observed attempting exploitation. The vulnerability is due to a path confusion issue between Nginx and Apache. A proof-of-concept exploit is publicly available. Over 2.3 million services are potentially exposed.
The vulnerability allows attackers to bypass authentication on the management web interface. The exploitation of this vulnerability has been observed, and a proof-of-concept exploit is available.
Recommendations
Update your PAN-OS instance to the latest version released on February 13, 2025, or later.
Restrict access to the PAN-OS management interface to only trusted internal IP addresses.
If the OpenConfig Plugin is not needed, disable or uninstall it.
Exploit
Fix
RCE
DoS
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pan-Os