This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Palo Alto Networks fixes 6 vulnerabilities, 2 of them actively exploited
Palo Alto Networks fixes 6 vulnerabilities in its products [1][2][3][4][5][6]. Two of them have already been added to CISA's Known Exploited Vulnerabilities catalog [7][8]. Products and their fixed versions: PAN-OS [1][3][4] 10.1 - 10.1.14-h9; 10.2 - 10.2.7-h24, 10.2.8-h21, 10.2.9-h21, 10.2.10-h14, 10.2.11-h12, 10.2.12-h6, 10.2.13-h3; 11.1 - 11.1.2-h18, 11.1.4-h13, 11.1.6-h1; 11.2 - 11.2.4-h4, 11.2.5; PAN-OS OpenConfig plugin - 2.1.2 [2]; Cortex XDR Broker VM - 26.0.116 [5]; Cortex XDR Agent (for Windows) - 8.3.101-CE, 8.5.1, 8.6 and later [6].
An unauthenticated remote attacker can bypass authentication in the PAN-OS web management interface and invoke certain PHP scripts, which, however, does not allow RCE [1]. The risk of attack can be significantly reduced by restricting access to the management interface to trusted internal IP addresses only, as recommended at [9]. Detailed information on verifying vulnerable devices in the infrastructure is available at [1]. A PoC exploit for the vulnerability is available at [10][11]. The vulnerability is already being actively exploited [7].
The vulnerability is present in product:
- *:Palo Alto Networks PAN-OS;>=10.1,<10.1.14-h9;>=10.2,<10.2.7-h24;>=10.2.8,<10.2.8-h21;>=10.2.9,<10.2.9-h21;>=10.2.10,<10.2.10-h14;>=10.2.11,<10.2.11-h12;>=10.2.12,<10.2.12-h6;>=10.2.13,<10.2.13-h3;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:C/RE:M/U:Red
More information:
- CVE-2025-0108 at cve.org, NVD
- CWE-306: Missing Authentication for Critical Function at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2025.
Due to a vulnerability in the PAN-OS OpenConfig plugin, an authenticated remote attacker with administrator privileges to create gNMI requests to the PAN-OS web management interface can execute arbitrary commands as the “__openconfig” user with the Device Administrator role on the firewall. The software is vulnerable if the OpenConfig plugin is enabled. It can be disabled, uninstalled or its version verified in Device > Plugin [2]. The risk of attack can be significantly reduced by restricting access to the management interface to trusted internal IP addresses only, as recommended at [9]. A PoC exploit for the vulnerability is available at [12].
The vulnerability is present in product:
- *:Palo Alto Networks PAN-OS OpenConfig Plugin;<2.1.2;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/AU:N/R:U/V:C/RE:M/U:Amber
More information:
- CVE-2025-0110 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2025.
An authenticated remote attacker with access to the PAN-OS web management interface can read files on the file system that are accessible to the "nobody" user [3]. The risk of attack can be significantly reduced by restricting access to the management interface to trusted internal IP addresses only, as recommended at [9]. Detailed information on verifying vulnerable devices in the infrastructure is available at [3]. The vulnerability is already being actively exploited [8].
The vulnerability is present in product:
- *:Palo Alto Networks PAN-OS;>=10.1,<10.1.14-h9;>=10.2,<10.2.7-h24;>=10.2.8,<10.2.8-h21;>=10.2.9,<10.2.9-h21;>=10.2.10,<10.2.10-h14;>=10.2.11,<10.2.11-h12;>=10.2.12,<10.2.12-h6;>=10.2.13,<10.2.13-h3;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:C/RE:M/U:Red
More information:
- CVE-2025-0111 at cve.org, NVD
- CWE-73: External Control of File Name or Path at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2025.
An unauthenticated remote attacker can delete certain files, including some logs and configuration files but not system files, as the “nobody” user in the PAN-OS web management interface [4]. The risk of attack can be significantly reduced by restricting access to the management interface to trusted internal IP addresses only, as recommended at [9]. Detailed information on verifying vulnerable devices in the infrastructure is available at [4].
The vulnerability is present in product:
- *:Palo Alto Networks PAN-OS;>=10.1,<10.1.14-h9;>=10.2,<10.2.7-h24;>=10.2.8,<10.2.8-h21;>=10.2.9,<10.2.9-h21;>=10.2.10,<10.2.10-h14;>=10.2.11,<10.2.11-h12;>=10.2.12,<10.2.12-h6;>=10.2.13,<10.2.13-h3;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/R:U/V:C/RE:M/U:Amber
More information:
- CVE-2025-0109 at cve.org, NVD
- CWE-73: External Control of File Name or Path at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2025.
Due to a flaw in the network isolation mechanism in Cortex XDR Broker VM, an unauthenticated remote attacker can gain unauthorized access to Docker containers running on the host network used by the Broker VM, which may lead, for example, to reading files intended for analysis and logs sent by Cortex XDR agents to the Cortex XDR server [5].
The vulnerability is present in product:
- *:Palo Alto Networks Cortex XDR Broker VM;<26.0.116;
CVSS: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:C/RE:M/U:Amber
More information:
- CVE-2025-0113 at cve.org, NVD
- CWE-424: Improper Protection of Alternate Path at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2025.
An authenticated local attacker without administrator privileges can disable the Cortex XDR Agent on Windows instances. The vulnerability can also be exploited by malware to deactivate the agent and subsequently carry out malicious activity [6].
The vulnerability is present in product:
- Windows:Palo Alto Networks Cortex XDR Agent;>=8.3,<8.3.101-CE;>=8.4,<=8.4.1;>=8.5,<8.5.1;
CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/U:Amber
More information:
- CVE-2025-0112 at cve.org, NVD
- CWE-754: Improper Check for Unusual or Exceptional Conditions at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2025.
Links
- [1] https://security.paloaltonetworks.com/CVE-2025-0108
- [2] https://security.paloaltonetworks.com/CVE-2025-0110
- [3] https://security.paloaltonetworks.com/CVE-2025-0111
- [4] https://security.paloaltonetworks.com/CVE-2025-0109
- [5] https://security.paloaltonetworks.com/CVE-2025-0113
- [6] https://security.paloaltonetworks.com/CVE-2025-0112
- [7] https://www.cisa.gov/news-events/alerts/2025/02/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
- [8] https://www.cisa.gov/news-events/alerts/2025/02/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
- [9] https://live.paloaltonetworks.com/t5/community-blogs/critical-recommendations-for-deployment-guides-how-to-secure-the/ba-p/464431
- [10] https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/
- [11] https://github.com/iSee857/CVE-2025-0108-PoC/blob/main/PanOs_CVE-2025-0108_LoginByPass.py
- [12] https://github.com/google/security-research/security/advisories/GHSA-73px-m3vw-mr35
By CESNET, z.s.p.o. Michaela Ručková on 24. 2. 2025.