CVE-2025-0108
Feb. 20, 2025, 3:15 a.m.
9.1
Critical
Description
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.
You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue does not affect Cloud NGFW or Prisma Access software.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| o | paloaltonetworks | pan-os | / | / | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | / | / | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | / | / | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | / | / | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | / | / | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.1.14 | - | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.1.14 | h2 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.1.14 | h4 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.1.14 | h6 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.1.14 | h8 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | - | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h1 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h12 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h16 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h18 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h19 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h21 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h3 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h6 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.7 | h8 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.8 | - | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.8 | h10 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.8 | h13 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.8 | h15 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.8 | h18 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.8 | h19 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.8 | h3 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.8 | h4 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.9 | - | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.9 | h1 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.9 | h11 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.9 | h14 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.9 | h16 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.9 | h18 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.9 | h19 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.9 | h9 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.12 | - | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.12 | h1 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.12 | h2 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.12 | h3 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.12 | h4 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.13 | - | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.13 | h1 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 10.2.13 | h2 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 11.1.6 | - | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 11.2.4 | - | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 11.2.4 | h1 | / | / | / | / | / | / |
| o | paloaltonetworks | pan-os | 11.2.4 | h2 | / | / | / | / | / | / |
References
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- Scope: UNCHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Timeline
Published: Feb. 12, 2025, 9:15 p.m.
Last Modified: Feb. 20, 2025, 3:15 a.m.
Last Modified: Feb. 20, 2025, 3:15 a.m.
Status : Modified
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
psirt@paloaltonetworks.com
Linked Attack Reports
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.