CVE-2025-0111
PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
At a glance Severity HIGH 7.1 Exploitation Known exploited (CISA KEV) · added 2025-02-20 Exploited per ENISA since 2025-02-20 EPSS EPSS 2.00 % · percentile 81 (2026-10-27) State PUBLISHED Published 2025-02-12 Updated 2026-02-26 Assigner palo_alto NVD status Analyzed Description An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue does not affect Cloud NGFW or Prisma Access software.
Scores Version Score Vector Scored by CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red palo_alto CVSS 4.0 MEDIUM 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber palo_alto CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Red NVD · psirt@paloaltonetworks.com (Secondary) CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 10.1.0 < 10.1.14cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 10.2.0 < 10.2.7cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 10.2.10 < 10.2.12cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.1.6cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 11.2.0 < 11.2.4cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h3:*:*:*:*:*:*+8 more Affected products
References
Sources
