CVE-2025-0115
PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI
Description
A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. You can greatly reduce the risk of this issue by restricting access to the management interface to only trusted users and internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access.
Weakness: CWE-41
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | PAN-OS Check your version | Firewall / NGFW | cna-assigner |
Vendor-reported products (3)
- Palo Alto Networks · PAN-OS
- Palo Alto Networks · Cloud NGFW — vendor states not affected
- Palo Alto Networks · Prisma Access — vendor states not affected
Credit
Visa Cybersecurity team
Vendor remediation
This issue is fixed in PAN-OS 10.1.14-h11, PAN-OS 10.2.11, PAN-OS 11.0.6, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions. Version Minor Version Suggested Solution PAN-OS 11.2 11.2.0 through 11.2.2Upgrade to 11.2.3 or later PAN-OS 11.111.1.0 through 11.1.4 Upgrade to 11.1.5 or laterPAN-OS 11.0 11.0.0 through 11.0.5 Upgrade to 11.0.6 or later PAN-OS 10.2 10.2.0 through 10.2.10Upgrade to 10.2.11 or laterPAN-OS 10.1 10.1.0 through 10.1.14 Upgrade to 10.1.14-h11 or later All other older unsupported PAN-OS versions Upgrade to a supported fixed version.