PAN-OS authentication bypass hole plugged, PoC is public (CVE-2025-0108)

Source: Help Net Security Author: Zeljka Zorz URL: https://www.helpnetsecurity.com/2025/02/13/pan-os-authentication-bypass-palo-alto-networks-poc-cve-2025-0108/

  1. ONE SENTENCE SUMMARY: Palo Alto Networks patched a high-severity authentication bypass vulnerability (CVE-2025-0108) in its firewalls, urging admins to update and restrict access.

  2. MAIN POINTS:

  3. Palo Alto Networks fixed CVE-2025-0108, an authentication bypass flaw in its firewall management web interface.

  4. A proof-of-concept (PoC) exploit for the vulnerability has been publicly released.

  5. The flaw was discovered while analyzing patches for previously exploited vulnerabilities, CVE-2024-0012 and CVE-2024-9474.

  6. Exploiting CVE-2025-0108 allows invoking PHP scripts, affecting PAN-OS integrity and confidentiality.

  7. The vulnerability has been patched in PAN-OS versions 11.2.4-h4, 11.1.6-h1, 10.2.13-h3, and 10.1.14-h9.

  8. Additional fixes include CVE-2025-0111 (authenticated file read) and CVE-2025-0109 (unauthenticated file deletion).

  9. Administrators are advised to disable management interface access from untrusted networks.

  10. Unexpected firewall reboots are due to a bug in PAN-OS 11.1.4-h7/h9, not an attack.

  11. A hotfix (11.1.4-h12) for the reboot issue was released with limited availability on January 31.

  12. Palo Alto Networks plans a general availability update (11.1.4-h13) by February 20.

  13. TAKEAWAYS:

  14. Update to the latest PAN-OS versions to mitigate security risks.

  15. Restrict access to the management web interface from untrusted sources.

  16. No known malicious exploitation of CVE-2025-0108 has been reported.

  17. Administrators should be aware of unexpected reboots caused by a software bug, not an attack.

  18. Additional security patches have been released, addressing multiple vulnerabilities in PAN firewalls.