CVE-2025-0108: 
PAN-OS vulnerability analysis and mitigation

An authentication bypass vulnerability (CVE-2025-0108) was discovered in the management web interface of Palo Alto Networks PAN-OS software. The vulnerability, disclosed on February 12, 2025, enables an unauthenticated attacker with network access to bypass authentication and invoke certain PHP scripts. The vulnerability affects PAN-OS versions 10.1, 10.2, 11.1, and 11.2, while Cloud NGFW and Prisma Access software remain unaffected. The flaw was discovered by Adam Kues from the Assetnote Security Research Team (PAN Advisory).

The vulnerability stems from a path confusion issue between Nginx and Apache components in the PAN-OS management interface. The authentication is set at the Nginx level based on HTTP headers, but the request is then re-processed in Apache, which may process the path or headers differently. This discrepancy in path processing between Nginx and Apache components allows attackers to bypass authentication controls. The vulnerability has been assigned a CVSS score of 8.8 (HIGH) and is being actively exploited in the wild (Searchlight Cyber).

While the vulnerability itself does not enable remote code execution directly, it can negatively impact the integrity and confidentiality of PAN-OS when exploited. The risk is highest when management interface access is allowed from external IP addresses on the internet. When chained with other vulnerabilities like CVE-2024-9474 and CVE-2025-0111, attackers can gain unauthorized access to unpatched and unsecured firewalls (SecurityWeek).

Palo Alto Networks has released patches for affected versions: PAN-OS 11.2.4-h4 or later, PAN-OS 11.1.6-h1 or later, PAN-OS 10.2.13-h3 or later, and PAN-OS 10.1.14-h9 or later. The recommended mitigation is to restrict management interface access to only trusted internal IP addresses according to critical deployment guidelines. Additionally, customers with a Threat Prevention subscription can block attacks by enabling Threat ID 510000 and 510001 (PAN Advisory).

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added CVE-2025-0108 to its 'Known Exploited Vulnerabilities' (KEV) catalog, requiring federal agencies to apply patches or mitigations by March 11, 2025. Security researchers and threat intelligence firms have actively tracked and reported on exploitation attempts, with GreyNoise observing an increase in malicious activity from 2 to 25 unique IP addresses within days of disclosure (BleepingComputer).