Active Exploitation of Palo Alto Networks PAN-OS Authentication Bypass (CVE-2025-0108)

A critical security vulnerability, identified as CVE-2025-0108, is under active exploitation in Palo Alto Networks PAN-OS firewalls. This high-severity flaw allows unauthenticated attackers to bypass authentication on the PAN-OS management web interface, potentially leading to complete system compromise. If you are running a Palo Alto Networks firewall, immediate action is required to secure your systems.

Vulnerability Details: Authentication Bypass in PAN-OS

The vulnerability resides within the PAN-OS management web interface and is classified as an authentication bypass. An attacker with network access to the vulnerable firewall can exploit this flaw to invoke specific PHP scripts without proper authentication. Successful exploitation grants the attacker the ability to:

• Bypass Authentication: Gain unauthorized access to the PAN-OS management interface.
• Invoke PHP Scripts: Execute arbitrary PHP scripts, potentially leading to further malicious actions.
• Compromise Integrity and Confidentiality: Exfiltrate sensitive system data, manipulate firewall configurations, and weaken security defenses.

Affected PAN-OS Versions and Remediation:

Palo Alto Networks has released a security bulletin urgently advising administrators to update their PAN-OS firewalls to the patched versions. The following PAN-OS versions are affected and require immediate patching:

• 11.2.4-h4 or later
• 11.1.6-h1 or later
• 10.2.13-h3 or later
• 10.1.14-h9 or later

It is crucial to note that PAN-OS 11.0, while also affected, has reached its End-of-Life (EoL). Palo Alto Networks will not release patches for this version, and users are strongly urged to migrate to a supported and actively maintained PAN-OS release.

Vulnerability Discovery and Technical Analysis:

Security researchers at Assetnote discovered and responsibly reported the vulnerability to Palo Alto Networks. Assetnote has also published a detailed technical write-up (Assetnote Write-up) outlining the exploitation process.

Their analysis reveals that the exploit leverages a path confusion vulnerability between Nginx and Apache within PAN-OS. This path confusion allows attackers to circumvent authentication mechanisms and gain unauthorized access. The researchers demonstrated that successful exploitation could lead to:

• Sensitive Data Extraction: Access and exfiltration of confidential system information.
• Firewall Configuration Retrieval: Download and analyze firewall configurations to identify weaknesses.
• Setting Manipulation: Potentially modify firewall settings, weakening security posture and creating backdoors.

Active Exploitation in the Wild:

Threat intelligence platforms like GreyNoise have detected active exploitation attempts targeting unpatched PAN-OS firewalls. Exploitation attempts began on February 13th, 2025, at 17:00 UTC, originating from multiple IP addresses. This suggests a coordinated effort by distinct threat actors to exploit this vulnerability rapidly.

GreyNoise Threat Activity is actively tracking these exploitation attempts, providing valuable insights into the evolving threat landscape.

Exposure of Vulnerable Devices:

Security researcher Yutaka Sejiyama of Macnica has highlighted the significant exposure of vulnerable devices. Over 4,400 PAN-OS devices are currently exposing their management interface directly to the internet. This widespread exposure dramatically increases the attack surface and the potential for widespread exploitation.

Mitigation and Recommendations:

To effectively defend against ongoing exploitation and mitigate the risk posed by CVE-2025-0108, immediate actions are critical:

1. Apply Patches Immediately: Upgrade your PAN-OS firewalls to the patched versions specified by Palo Alto Networks in their security bulletin. Prioritize patching internet-facing firewalls and critical infrastructure.
2. Restrict Management Interface Access: Implement strict access control policies to limit access to the PAN-OS management interface. Where possible, restrict access to trusted networks or utilize VPNs for secure remote management. Do not expose the management interface directly to the public internet.
3. Monitor for Suspicious Activity: Closely monitor firewall logs for any indicators of compromise or unauthorized access attempts, especially those originating from unexpected sources.

Conclusion:

The CVE-2025-0108 vulnerability in Palo Alto Networks PAN-OS firewalls represents a serious security risk. With active exploitation underway and a public proof-of-concept (PoC) exploit available, organizations using affected PAN-OS versions must act decisively and immediately to apply the necessary patches and implement recommended security measures.