CVE-2025-0111: PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface (Severity: HIGH)
An authenticated file read vulnerability in the management web interface of the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
The attacker must have network access to the management web interface to exploit this issue. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).
This issue does not affect Cloud NGFW or Prisma Access software.
Other sources
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue does not affect Cloud NGFW or Prisma Access software.
— MITRE
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.1.14-h9Fixed in 10.2.7-h24Fixed in 10.2.8-h21Fixed in 10.2.9-h21Fixed in 10.2.12-h6Fixed in 10.2.13-h3Fixed in 10.2.10-h14Fixed in 10.2.11-h12Fixed in 11.1.6-h1Fixed in 11.1.2-h18Fixed in 11.1.4-h13Fixed in 11.2.4-h4Fixed in 11.2.5 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.1.14-h9 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.7-h24 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.8-h21 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.9-h21 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.10-h14 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.11-h12 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.12-h6 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.13-h3 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.2-h18 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.4-h13 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.6-h1 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.4-h4 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.5 - Configuration
Enable Threat ID 510000 and 510001 in Threat Prevention (requires Applications and Threats content version 8943 or later) to block attacks targeting this vulnerability.
Threat Prevention (Applications and Threats content) Threat ID 510000 and 510001 = enabled - Compensating control
Restrict access to the management web interface to only trusted internal IP addresses by configuring management-interface ACLs or firewall rules to permit only specific management IP ranges.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0111?
CVE-2025-0111 has been classified as a high severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2025-0111?
To mitigate CVE-2025-0111, upgrade to PAN-OS versions 10.1.14-h9, 10.2.13-h3, 11.1.6-h1, or 11.2.4-h4.
Who is affected by CVE-2025-0111?
CVE-2025-0111 affects users of Palo Alto Networks PAN-OS, Cloud NGFW, and Prisma Access running vulnerable versions.
What kind of access does CVE-2025-0111 require?
CVE-2025-0111 requires an authenticated attacker to have network access to the management web interface.
What can an attacker do with CVE-2025-0111?
An attacker exploiting CVE-2025-0111 can read files on the PAN-OS filesystem that are accessible by the 'nobody' user.