CVE-2025-0109: 
PAN-OS vulnerability analysis and mitigation

An unauthenticated file deletion vulnerability (CVE-2025-0109) was discovered in the Palo Alto Networks PAN-OS management web interface. The vulnerability was disclosed on February 12, 2025, and affects multiple versions of PAN-OS software. This security flaw enables an unauthenticated attacker with network access to the management web interface to delete certain files as the 'nobody' user, including limited logs and configuration files, but not system files (PAN Security).

The vulnerability has been assigned a CVSS score of 5.5 (MEDIUM) with a CVSS:4.0 base score of 6.9. The vulnerability is classified under CWE-73: External Control of File Name or Path and CAPEC-165: File Manipulation. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires no user interaction (UI:N) or privileges (PR:N). The vulnerability affects the integrity of the system (VI:L) but does not impact confidentiality or availability (PAN Security).

The vulnerability allows attackers to delete certain files as the 'nobody' user, specifically affecting limited logs and configuration files. The impact is greatest when access to the management interface is enabled from the internet or untrusted networks. The risk can be significantly reduced by restricting management interface access to trusted internal IP addresses (PAN Security).

Affected organizations should upgrade to the following fixed versions: PAN-OS 11.2.4-h4 or later, PAN-OS 11.1.6-h1 or later, PAN-OS 10.2.13-h3 or later, and PAN-OS 10.1.14-h9 or later. As a recommended mitigation, organizations should restrict management interface access to only trusted internal IP addresses according to Palo Alto Networks' critical deployment guidelines. GlobalProtect portals and gateways are not vulnerable to this issue unless a management profile is configured on their interfaces (PAN Security).

The vulnerability has garnered attention from the cybersecurity community, with security researchers from Michelin CERT (Maxime Escourbiac and Yassine Bengana) and watchTowr (Sonny) being credited for discovering and reporting the issue. The vulnerability was also acknowledged by Palo Alto Networks' Deep Product Security Research Team (PAN Security).