Vulnerability Description
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks | Pan-Os | >= 10.1.0, < 10.1.14 |
Related Weaknesses (CWE)
References
- https://security.paloaltonetworks.com/CVE-2025-0108ExploitVendor Advisory
- https://github.com/iSee857/CVE-2025-0108-PoCExploitThird Party Advisory
- https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/ExploitPress/Media Coverage
- https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewPress/Media CoverageThird Party Advisory
- https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palPress/Media CoverageThird Party Advisory
- https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewalPress/Media CoverageThird Party Advisory
- https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/Press/Media CoverageThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-US Government Resource
FAQ
What is CVE-2025-0108?
CVE-2025-0108 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise requir...
How severe is CVE-2025-0108?
CVE-2025-0108 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-0108?
Check the references section above for vendor advisories and patch information. Affected products include: Paloaltonetworks Pan-Os.