CyberSecBulletin
CVE-2025-0111Exploited in the wildNVD status: Analyzed

Palo Alto Networks PAN-OS File Read

Published Updated By the CyberSecBulletin desk

CVE-2025-0111 is a medium-severity externally controlled reference to a resource in another sphere vulnerability in Cloud NGFW from Palo Alto Networks, with a CVSS 3.1 base score of 6.5 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. CISA added it to the Known Exploited Vulnerabilities catalogue on February 20, 2025, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update PAN-OS to 10.1.14-h9 or 10.2.7-h24 or 11.1.6-h1 or 11.2.4-h4, whichever matches your release line, or a later version.
  2. CISA's required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  3. Read the advisory on security.paloaltonetworks.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
Palo Alto NetworksCloud NGFWNot specified in the recordNot stated
Palo Alto NetworksPAN-OS10.1.0 up to, but not including, 10.1.14-h9; 10.2.0 up to, but not including, 10.2.7-h24; 11.1.0 up to, but not including, 11.1.6-h1; 11.2.0 up to, but not including, 11.2.4-h410.1.14-h9, 10.2.7-h24, 11.1.6-h1, 11.2.4-h4
Palo Alto NetworksPrisma AccessNot specified in the recordNot stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.07.1HighCNA (paloaltonetworks.com)
CVSS 3.16.5MediumNVD

Official description

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

More Externally Controlled Reference to a Resource in Another Sphere vulnerabilities (CWE-610)

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other vulnerabilities in Cloud NGFW

All Cloud NGFW vulnerabilities

Recent Externally Controlled Reference to a Resource in Another Sphere vulnerabilities

Spotted an error? Tell us.