Exploited
high
7.1
CWE
73 610
Advisory Published
CVE Published
Updated
Advisory Published

CVE-2025-0111: PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface (Severity: HIGH)

First published: Wed Feb 12 2025(Updated: )

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

Credit: psirt@paloaltonetworks.com

Affected SoftwareAffected VersionHow to fix
Palo Alto Networks Cloud NGFW
Palo Alto PAN-OS<10.1.14-h9=10.1.0<10.2.7-h24=10.2.0<11.1.6-h1=11.1.0<11.2.4-h4=11.2.0
10.1.14-h9
10.2.7-h24
10.2.8-h21
10.2.9-h21
10.2.12-h6
10.2.13-h3
10.2.10-h14
10.2.11-h12
11.1.6-h1
11.1.2-h18
11.2.4-h4
Palo Alto Networks Prisma Access
Palo Alto PAN-OS
Palo Alto Networks PAN-OS>=10.1.0<10.1.14
Palo Alto Networks PAN-OS>=10.2.0<10.2.7
Palo Alto Networks PAN-OS>=10.2.10<10.2.12
Palo Alto Networks PAN-OS>=11.0.0<11.1.6
Palo Alto Networks PAN-OS>=11.2.0<11.2.4
Palo Alto Networks PAN-OS=10.1.14
Palo Alto Networks PAN-OS=10.1.14-h2
Palo Alto Networks PAN-OS=10.1.14-h4
Palo Alto Networks PAN-OS=10.1.14-h6
Palo Alto Networks PAN-OS=10.1.14-h8
Palo Alto Networks PAN-OS=10.2.7
Palo Alto Networks PAN-OS=10.2.7-h1
Palo Alto Networks PAN-OS=10.2.7-h12
Palo Alto Networks PAN-OS=10.2.7-h16
Palo Alto Networks PAN-OS=10.2.7-h18
Palo Alto Networks PAN-OS=10.2.7-h19
Palo Alto Networks PAN-OS=10.2.7-h21
Palo Alto Networks PAN-OS=10.2.7-h3
Palo Alto Networks PAN-OS=10.2.7-h6
Palo Alto Networks PAN-OS=10.2.7-h8
Palo Alto Networks PAN-OS=10.2.8
Palo Alto Networks PAN-OS=10.2.8-h10
Palo Alto Networks PAN-OS=10.2.8-h13
Palo Alto Networks PAN-OS=10.2.8-h15
Palo Alto Networks PAN-OS=10.2.8-h18
Palo Alto Networks PAN-OS=10.2.8-h19
Palo Alto Networks PAN-OS=10.2.8-h3
Palo Alto Networks PAN-OS=10.2.8-h4
Palo Alto Networks PAN-OS=10.2.9
Palo Alto Networks PAN-OS=10.2.9-h1
Palo Alto Networks PAN-OS=10.2.9-h11
Palo Alto Networks PAN-OS=10.2.9-h14
Palo Alto Networks PAN-OS=10.2.9-h16
Palo Alto Networks PAN-OS=10.2.9-h18
Palo Alto Networks PAN-OS=10.2.9-h19
Palo Alto Networks PAN-OS=10.2.9-h9
Palo Alto Networks PAN-OS=10.2.12
Palo Alto Networks PAN-OS=10.2.12-h1
Palo Alto Networks PAN-OS=10.2.12-h2
Palo Alto Networks PAN-OS=10.2.12-h3
Palo Alto Networks PAN-OS=10.2.12-h4
Palo Alto Networks PAN-OS=10.2.13
Palo Alto Networks PAN-OS=10.2.13-h1
Palo Alto Networks PAN-OS=10.2.13-h2
Palo Alto Networks PAN-OS=11.1.6
Palo Alto Networks PAN-OS=11.2.4
Palo Alto Networks PAN-OS=11.2.4-h1
Palo Alto Networks PAN-OS=11.2.4-h2

Remedy

Recommended mitigation—The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our best practices deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431). Specifically, you should restrict management interface access to only trusted internal IP addresses. Review information about how to secure management access to your Palo Alto Networks firewalls: * Palo Alto Networks LIVEcommunity article:https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 * Palo Alto Networks official and detailed technical documentation:https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices Additionally, customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510000 and 510001 (introduced in Applications and Threats content version 8943). https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices

Remedy

VERSION MINOR VERSION SUGGESTED SOLUTION PAN-OS 10.1 10.1.0 through 10.1.14 Upgrade to 10.1.14-h9 or later PAN-OS 10.2 10.2.0 through 10.2.13 Upgrade to 10.2.13-h3 or later   10.2.7 Upgrade to 10.2.7-h24 or 10.2.13-h3 or later   10.2.8 Upgrade to 10.2.8-h21 or 10.2.13-h3 or later   10.2.9 Upgrade to 10.2.9-h21 or 10.2.13-h3 or later   10.2.10 Upgrade to 10.2.10-h14 or 10.2.13-h3 or later   10.2.11 Upgrade to 10.2.11-h12 or 10.2.13-h3 or later   10.2.12 Upgrade to 10.2.12-h6 or 10.2.13-h3 or later PAN-OS 11.0 (EoL)   Upgrade to a supported fixed version PAN-OS 11.1 11.1.0 through 11.1.6 Upgrade to 11.1.6-h1 or later   11.1.2 Upgrade to 11.1.2-h18 or 11.1.6-h1 or later PAN-OS 11.2 11.2.0 through 11.2.4 Upgrade to 11.2.4-h4 or later Note: PAN-OS 11.0 reached end of life (EoL) on November 17, 2024. No additional fixes are planned for this release.

Remedy

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is the severity of CVE-2025-0111?

    CVE-2025-0111 has been classified as a high severity vulnerability due to its potential for unauthorized file access.

  • How do I fix CVE-2025-0111?

    To mitigate CVE-2025-0111, upgrade to PAN-OS versions 10.1.14-h9, 10.2.13-h3, 11.1.6-h1, or 11.2.4-h4.

  • Who is affected by CVE-2025-0111?

    CVE-2025-0111 affects users of Palo Alto Networks PAN-OS, Cloud NGFW, and Prisma Access running vulnerable versions.

  • What kind of access does CVE-2025-0111 require?

    CVE-2025-0111 requires an authenticated attacker to have network access to the management web interface.

  • What can an attacker do with CVE-2025-0111?

    An attacker exploiting CVE-2025-0111 can read files on the PAN-OS filesystem that are accessible by the 'nobody' user.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203