Critical PAN-OS Vulnerabilities Enable Root Access Exploitation

EXECUTIVE SUMMARY:

A critical vulnerability CVE-2025-0108 in Palo Alto Networks PAN-OS web management interface, rated 8.8/10 on the CVSS scale, is under active exploitation. Attackers are chaining this flaw with two other vulnerabilities, CVE-2024-9474 with a CVSS score of 6.9 and CVE-2025-0111 with a CVSS score of 7.1 to bypass authentication, escalate privileges, and gain root access to affected firewalls. Unpatched systems with internet-facing management interfaces are at high risk. Immediate patching is strongly recommended to mitigate the threat.[emaillocker id="1283"]

• CVE-2025-0111: This vulnerability allows authenticated attackers with network access to the PAN-OS web interface to read files accessible to the “nobody” user. While it requires authentication, when combined with other flaws, it significantly enhances an attacker’s ability to escalate privileges and compromise the system.

The chaining of these vulnerabilities poses a severe risk to unpatched PAN-OS systems, enabling attackers to bypass authentication, escalate privileges, and gain root access. Organizations must act immediately to secure their systems.

RECOMMENDATION:

We strongly recommend you update Palo Alto products to below versions:

REFERENCES:

The following reports contain further technical details:
https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/