CVE-2025-0111
Palo Alto Networks PAN-OS File Read Vulnerability
Description
CVE-2025-0111 is a medium-severity authenticated file read vulnerability in Palo Alto Networks PAN-OS that allows an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem readable by the "nobody" user. Rated with a CVSS v3.1 base score of 6.5, this vulnerability affects multiple PAN-OS versions across the 10.1, 10.2, 11.0, 11.1, and 11.2 release branches. CISA has added CVE-2025-0111 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 13, 2025, confirming active exploitation. The EPSS score of 2.02% at the 83.5th percentile indicates elevated exploitation probability, and Palo Alto Networks strongly recommends restricting management interface access to trusted internal IP addresses.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | >= 10.1.0, < 10.1.14; >= 10.2.0, < 10.2.7; >= 10.2.10, < 10.2.12; >= 11.0.0, < 11.1.6; >= 11.2.0, < 11.2.4; 10.1.14; 10.2.7; 10.2.8; 10.2.9; 10.2.12; 10.2.13; 11.1.6; 11.2.4 |
References
- https://security.paloaltonetworks.com/CVE-2025-0111(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0111(US Government Resource)
Weakness Type
Authenticated File Read / Path Traversal
CVE-2025-0111 involves an authenticated file read vulnerability that allows access to files on the PAN-OS filesystem that are readable by the "nobody" user. This type of weakness typically involves insufficient input validation or path traversal protections in file access operations, enabling an attacker to read files outside the intended directory scope. The vulnerability allows authenticated users to access sensitive system files, configuration data, and potentially credentials stored on the firewall filesystem.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2025-0111 poses a significant information disclosure risk to organizations running affected Palo Alto Networks firewalls. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), requiring low-level privileges (PR:L) and no user interaction (UI:N). Confidentiality (High): The primary impact is unauthorized file read access. An attacker can read any file on the PAN-OS filesystem that is accessible to the "nobody" user, which may include firewall configuration files, routing tables, VPN configurations, certificate files, log data, and potentially hashed credentials. This information can be leveraged for lateral movement, network reconnaissance, and further exploitation of the infrastructure. Integrity and Availability: The CVSS vector indicates no direct integrity (I:N) or availability (A:N) impact, as the vulnerability only enables file reading, not modification or service disruption. However, the disclosed information can enable more impactful follow-on attacks. The EPSS score of 2.02% at the 83.5th percentile, combined with the KEV catalog inclusion, confirms that attackers are actively exploiting this vulnerability. The ransomware status is listed as Unknown, but file read access to firewall configurations could facilitate network-wide compromise leading to ransomware deployment.
Exploit Maturity
CVE-2025-0111 has confirmed exploit maturity with active exploitation in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 13, 2025, confirming real-world exploitation. Palo Alto Networks has published a security advisory providing detailed information about affected versions and mitigation guidance. The EPSS score of 2.02% at the 83.5th percentile indicates significantly elevated exploitation probability compared to the baseline. The ransomware use status is listed as Unknown by CISA. Palo Alto Networks emphasizes that restricting access to the management web interface to trusted internal IP addresses greatly reduces the risk of exploitation, suggesting that internet-exposed management interfaces are a primary attack vector.
Remediation
-
Upgrade PAN-OS to a patched version immediately. Apply the following minimum versions based on your current PAN-OS branch: 10.1.14-h9 or later for the 10.1 branch, 10.2.13-h3 or later for the 10.2 branch, 11.1.6-h1 or later for the 11.1 branch, and 11.2.4-h4 or later for the 11.2 branch. Consult the Palo Alto Networks security advisory for the exact patched versions.
-
Restrict management web interface access immediately. Configure access control lists to limit management interface access to only trusted internal IP addresses. This is the most critical interim mitigation and should be implemented even before patching is complete. Remove any internet-facing management interface exposure.
-
Audit management interface access logs. Review PAN-OS management interface authentication and access logs for any signs of unauthorized file read activity. Look for unusual file access patterns, authentication from unexpected source IPs, and any exploitation indicators documented by Palo Alto Networks.
-
Implement network segmentation for management traffic. Place all firewall management interfaces on a dedicated, isolated management network with strict access controls. Use jump servers or bastion hosts for administrative access and enforce multi-factor authentication for all management sessions.
-
Monitor for chained exploitation. CVE-2025-0111 may be used in combination with other PAN-OS vulnerabilities (such as CVE-2025-0108) for chained attacks. Review your PAN-OS deployment for all currently known vulnerabilities and apply comprehensive patching across all affected systems.
Technical Details
CVE-2025-0111 is an authenticated file read vulnerability in the Palo Alto Networks PAN-OS management web interface. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates the following: Attack Vector (Network): The vulnerability is exploitable through the PAN-OS management web interface, which is accessible over the network. Attack Complexity (Low): Exploitation is straightforward once the attacker has authenticated access. Privileges Required (Low): A valid PAN-OS management interface account with basic privileges is sufficient to exploit the vulnerability. User Interaction (None): No additional user interaction is required. Confidentiality (High): The attacker gains read access to files on the PAN-OS filesystem that are readable by the "nobody" user, potentially including sensitive configuration data and credentials. Integrity and Availability (None): The vulnerability does not enable file modification or service disruption. The affected versions span multiple PAN-OS release branches: 10.1.x versions before 10.1.14 (with specific build exclusions), 10.2.x versions before 10.2.7 and between 10.2.10 and 10.2.12, 11.0.x versions before 11.1.6, and 11.2.x versions before 11.2.4. The vulnerability resides in the management web interface's file handling mechanisms, which fail to properly restrict file access operations to authorized paths, allowing an authenticated user to craft requests that read arbitrary files accessible to the "nobody" user context on the PAN-OS operating system.
Frequently Asked Questions
Is CVE-2025-0111 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-0111 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 13, 2025. Palo Alto Networks has also acknowledged the exploitation and recommends immediately restricting management interface access.
What can an attacker read with CVE-2025-0111?
An attacker can read any file on the PAN-OS filesystem that is accessible to the "nobody" user. This may include firewall configuration files, routing tables, VPN configurations, log files, and potentially credential stores, depending on the file permission structure of the specific PAN-OS version.
How do I mitigate CVE-2025-0111?
The most important immediate step is to restrict management web interface access to trusted internal IP addresses only. Then upgrade to a patched PAN-OS version as specified in the Palo Alto Networks security advisory. Never expose the PAN-OS management interface to the public internet.
Is CVE-2025-0111 related to CVE-2025-0108?
Both CVE-2025-0111 and CVE-2025-0108 affect the PAN-OS management web interface and were disclosed around the same time. While CVE-2025-0111 is an authenticated file read vulnerability, CVE-2025-0108 is an authentication bypass. These vulnerabilities could potentially be chained together for more severe exploitation, making it critical to patch both simultaneously.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.