CVE-2025-0108KEV · OVERDUECWE-306

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Critical · published February 13, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.1. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

591
days past CISA
deadline
CVSS v3.1
9.1
EPSS
98%
Percentile
99.9
In the wild
Confirmed
What it is

⚡ An authentication bypass lurking in PAN-OS can let attackers through the front door without a key! Think of it like a hotel with a management office that anyone can stroll into, bypassing the security checkpoint. Without proper access control, sensitive information is just hanging out in plain sight! This vulnerability could allow an unauthenticated attacker with network access to the management interface to invoke certain PHP scripts. While it doesn’t lead to full remote code execution, it puts your system's integrity and confidentiality at risk, making it a high-stakes game for those trying to protect sensitive data.

Put simply

Think of it like a hotel with a management office that anyone can stroll into, bypassing the security checkpoint. Without proper access control, sensitive information is just hanging out in plain sight! The flaw in the Palo Alto Networks PAN-OS software permits attackers to bypass the usual authentication checks on the management web interface, enabling unauthorized access to specific PHP scripts.

What to do

This vulnerability could allow an unauthenticated attacker with network access to the management interface to invoke certain PHP scripts. While it doesn’t lead to full remote code execution, it puts your system's integrity and confidentiality at risk, making it a high-stakes game for those trying to protect sensitive data. To mitigate this risk, restrict access to the management web interface to trusted internal IP addresses only. Follow the best practices outlined in Palo Alto’s deployment guidelines to secure your setup effectively. It's time to tighten those security measures! You've got this! By taking these steps, you can safeguard your system and keep those intruders out! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.98455 · 99.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-02-13T02:15Z
KEV added
2025-02-18 · due 2025-03-11
Affected products (151)
ProductVersionsFixed in
paloaltonetworks/pan-os≥ 10.1.0, < 10.1.1410.1.14
paloaltonetworks/pan-os≥ 10.2.0, < 10.2.710.2.7
paloaltonetworks/pan-os≥ 11.1.0, < 11.1.211.1.2
paloaltonetworks/pan-os≥ 11.2.0, < 11.2.411.2.4
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
References (8)
EPSS history
Timeline
  • 18 FEB 00:00Z
    Added to CISA KEV — remediate by Mar 11
    kev
  • 12 FEB 20:55Z
    PAN-OS: Authentication Bypass in the Management Web Interface
    cvelistv5