PAN-OS authentication bypass hole plugged, PoC is public (CVE-2025-0108)

Source: Help Net Security Author: Zeljka Zorz URL: https://www.helpnetsecurity.com/2025/02/13/pan-os-authentication-bypass-palo-alto-networks-poc-cve-2025-0108/

ONE SENTENCE SUMMARY:

Palo Alto Networks patched a high-severity authentication bypass vulnerability (CVE-2025-0108) in its firewalls, urging admins to update and restrict access.

MAIN POINTS:

  1. Palo Alto Networks fixed CVE-2025-0108, an authentication bypass flaw in its firewall management web interface.
  2. A proof-of-concept (PoC) exploit for the vulnerability has been publicly released.
  3. The flaw was discovered while analyzing patches for previously exploited vulnerabilities, CVE-2024-0012 and CVE-2024-9474.
  4. Exploiting CVE-2025-0108 allows invoking PHP scripts, affecting PAN-OS integrity and confidentiality.
  5. The vulnerability has been patched in PAN-OS versions 11.2.4-h4, 11.1.6-h1, 10.2.13-h3, and 10.1.14-h9.
  6. Additional fixes include CVE-2025-0111 (authenticated file read) and CVE-2025-0109 (unauthenticated file deletion).
  7. Administrators are advised to disable management interface access from untrusted networks.
  8. Unexpected firewall reboots are due to a bug in PAN-OS 11.1.4-h7/h9, not an attack.
  9. A hotfix (11.1.4-h12) for the reboot issue was released with limited availability on January 31.
  10. Palo Alto Networks plans a general availability update (11.1.4-h13) by February 20.

TAKEAWAYS:

  1. Update to the latest PAN-OS versions to mitigate security risks.
  2. Restrict access to the management web interface from untrusted sources.
  3. No known malicious exploitation of CVE-2025-0108 has been reported.
  4. Administrators should be aware of unexpected reboots caused by a software bug, not an attack.
  5. Additional security patches have been released, addressing multiple vulnerabilities in PAN firewalls.