Palo Alto Networks Fixes Critical Vulnerabilities in PAN-OS: Authentication Bypass and More

2025-02-13

Palo Alto Networks has recently addressed several critical vulnerabilities in its PAN-OS software, one of which could allow unauthorized attackers to bypass authentication mechanisms. Tracked as CVE-2025-0108, this flaw has been assigned a high-severity CVSS score of 7.8 out of 10, highlighting the importance of timely patching. The vulnerability affects specific versions of PAN-OS, and the company has issued security updates to mitigate the risks. In addition to this flaw, two other vulnerabilities, including one with the potential for command injection, have also been patched.

the Vulnerabilities:

Palo Alto Networks’ PAN-OS software, which powers the company’s next-generation firewalls and network security appliances, was found to contain a serious vulnerability (CVE-2025-0108) that allows attackers to bypass the authentication required for accessing the management web interface. This flaw, assigned a CVSS score of 7.8, could be exploited by unauthenticated attackers with network access, allowing them to trigger PHP scripts that compromise the integrity and confidentiality of the system. However, it doesn’t permit remote code execution.

The vulnerability affects several PAN-OS versions, including:

PAN-OS 11.2 < 11.2.4-h4 (Fixed in >= 11.2.4-h4)
PAN-OS 11.1 < 11.1.6-h1 (Fixed in >= 11.1.6-h1)
PAN-OS 10.2 < 10.2.13-h3 (Fixed in >= 10.2.13-h3)
PAN-OS 10.1 < 10.1.14-h9 (Fixed in >= 10.1.14-h9)

A researcher from Searchlight Cyber, Adam Kues, discovered that the flaw arises from a mishandling of incoming requests between Nginx and Apache components, enabling a directory traversal attack.

In addition to the authentication bypass, Palo Alto Networks addressed two other vulnerabilities:
– CVE-2025-0109: An unauthenticated file deletion vulnerability (CVSS: 5.5), which could allow an attacker to delete logs and configuration files.
– CVE-2025-0110: A command injection vulnerability (CVSS: 7.3) in the OpenConfig plugin, which allows authenticated administrators to bypass system restrictions and execute arbitrary commands.

Palo Alto Networks has released updates to patch these vulnerabilities and recommends customers disable or restrict management interface access to trusted networks only.

What Undercode Says:

The discovered vulnerabilities in PAN-OS by Palo Alto Networks are significant, considering the potential impact on users who fail to address them. The authentication bypass vulnerability (CVE-2025-0108) stands out due to its potential for misuse by unauthenticated attackers. Given the large user base of PAN-OS and the role it plays in securing enterprise networks, an attacker gaining unauthorized access to the management interface could have disastrous consequences, even without remote code execution. The ability to execute certain PHP scripts could lead to the disclosure of sensitive data, altering configurations or disabling critical functions.

While the CVSS score of 7.8 for CVE-2025-0108 indicates a severe risk, the security flaw’s impact is mitigated if access to the management interface is restricted to a “jump box” or another trusted gateway. However, in any scenario where access is not sufficiently controlled, the risk remains high. Attackers could leverage this flaw to gain a foothold in the network, potentially escalating their access privileges further within the system.

Another interesting aspect of the vulnerability is its root cause: a discrepancy between the way Nginx and Apache handle incoming requests. This highlights an important consideration for developers and security experts: even minor differences in configuration or software integration can introduce significant vulnerabilities. As seen in this case, these two web server components, when not properly configured, enabled the possibility of a directory traversal attack, a method often used by attackers to access restricted directories and files that should be off-limits.

In addition to CVE-2025-0108, Palo Alto Networks has patched two other vulnerabilities—CVE-2025-0109 and CVE-2025-0110. While CVE-2025-0109 (unauthenticated file deletion) presents a lower risk compared to the authentication bypass, it still poses a threat to the integrity of system configurations and logs. Attackers could delete critical files, potentially hindering the ability to recover from an attack or properly diagnose issues.

Meanwhile, CVE-2025-0110 (command injection in OpenConfig) represents a more sophisticated risk, as it could allow attackers to bypass system restrictions and execute arbitrary commands on the device, making it a substantial threat for any environment where the OpenConfig plugin is enabled.

The combination of these three vulnerabilities in the same security release from Palo Alto Networks underscores the necessity of comprehensive security management practices. While these flaws can be mitigated by the timely application of patches, organizations must also ensure that their devices are configured securely. For instance, restricting access to the management interface from untrusted networks is a critical step in reducing the attack surface. Organizations using the OpenConfig plugin must evaluate whether it is necessary for their environment or if it can be disabled entirely to further reduce the potential attack vector.

These vulnerabilities, especially in widely used network security products like those from Palo Alto Networks, emphasize the importance of proactive security management, patching, and configuration control. The cybersecurity community must remain vigilant and ensure that all aspects of their network infrastructure are tightly secured against emerging threats.

References:

Reported By: https://thehackernews.com/2025/02/palo-alto-networks-patches.html
https://www.quora.com/topic/Technology
Wikipedia: https://www.wikipedia.org
Undercode AI: https://ai.undercodetesting.com