CVE-2025-0111
PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
- High 7.1
- Exploited: added to CISA KEV 20 Feb 2025
Description
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
Key facts
- Published
- 12 Feb 2025
- Last changed
- 26 Feb 2026
- Assigned by
- palo_alto
- KEV added
- 20 Feb 2025
- KEV fix due
- 13 Mar 2025
- EPSS
- 1.999% likely to be exploited in the next 30 days, higher than 81.076% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: active; Automatable: no; Technical impact: partial
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 7.1CVSS 4.0, Highfrom the CNA (palo_alto)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red - 5.9CVSS 4.0, Mediumfrom the CNA (palo_alto)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber
What to do
- Recommended mitigation—The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 * Palo Alto Networks official and detailed technical documentation: https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices Additionally, customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510000 and 510001 (introduced in Applications and Threats content version 8943). https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practicesCNA workaround statement
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
CAPEC-165 File Manipulation (CNA impact statement)
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Cloud NGFW |
|
| Palo Alto Networks | PAN-OS |
|
| Palo Alto Networks | Prisma Access |
|
Timeline
- 12 Feb 2025 Initial Publication
- 12 Feb 2025 Published
- 12 Feb 2025 Added Threat Prevention Threat ID to Workarounds and Mitigations
- 18 Feb 2025 Updated fix availability for PAN-OS 10.2
- 18 Feb 2025 Updated exploit status and solution table
- 19 Feb 2025 Updated fix availability for PAN-OS 10.2 and 11.1
- 20 Feb 2025 CVE-2025-0111 added to CISA KEV
- 20 Feb 2025 Added to the CISA KEV catalogue