A high-severity authentication bypass vulnerability in PAN-OS software, CVE-2025-0108, was disclosed. This flaw allows unauthenticated attackers with network access to bypass authentication and invoke PHP scripts, compromising system integrity and confidentiality. Read this Cybersecurity Threat Advisory to learn how you can protect your organization from this vulnerability.
What is the threat?
CVE-2025-0108 is an authentication bypass in Palo Alto Networks’ PAN-OS, caused by inconsistent handling of web requests by Nginx, Apache, and the embedded PHP application. This discrepancy allows an unauthenticated attacker to craft specially designed HTTP requests that bypass the authentication mechanism, granting unauthorized access to certain PHP scripts. Exploitation of this vulnerability involves the attacker gaining network access to the PAN-OS management interface. By sending crafted requests that omit proper authentication tokens, the attacker can invoke PHP scripts intended only for authorized users. This unauthorized access can lead to exposure of sensitive configuration data and potential modification of firewall settings, thereby compromising network security.
Why is it noteworthy?
This vulnerability is particularly dangerous because it does not require valid credentials. Attackers can access with only network access to the management interface to exploit it. The ability for an unauthenticated attacker to bypass authentication mechanisms and access sensitive functions within the PAN-OS management interface poses a significant security risk. Since the proof-of-concept of the exploitation have been made public, it increases the likelihood of widespread exploitation. Organizations using affected PAN-OS versions must act swiftly to mitigate this threat and protect their network infrastructure.
What is the exposure or risk?
What are the recommendations?
Barracuda strongly recommends taking the following actions to protect your network against this threat:
- Update PAN-OS software versions to 11.2.4 H4 or later, 11.1.6 H1 or later, 10.2.13 H3 or later, and 10.1.14 H9 or later.
- Ensure access to the PAN-OS management web interface is limited to trusted internal IP addresses only.
- Avoid exposing the management interface to the internet or untrusted networks.
- Regularly review firewall and management interface configurations to ensure adherence to security best practices and to minimize potential attack vectors.
References:
For more in-depth information about the threat, please visit the following links:
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.