Dive Brief:
- Palo Alto Networks on Monday confirmed that a high severity vulnerability, listed as CVE-2025-0108, in its PAN-OS management web interface was being exploited by attackers in the wild.
- The authentication bypass vulnerability, when chained with the CVE-2024-9474 privilege escalation vulnerability, could allow an attacker to gain access to unsecured and unpatched firewalls.
- “We are urging all customers with internet-facing PAN-OS management interfaces to immediately apply the security updates released on Feb. 12, 2025,” Steven Thai, a spokesperson for Palo Alto Networks said via email.
Dive Insight:
Researchers from AssetNote discovered the zero-day authentication bypass in the PAN-OS management interface while investigating previously disclosed exploit activity linked to PAN -OS flaws CVE-2024-0012 and CVE-2024-9474.
CVE-2024-0012, with a CVSS score of 9.3, allows unauthenticated attackers with network access to obtain PAN-OS administrator privileges and potentially tamper with device configuration. The vulnerability could allow attackers to exploit other authenticated privilege escalation bugs, such as CVE-2024-9474.
“Attackers have to combine it with another exploit in order to achieve command execution,” said Shubham Shah, co-founder and CTO of AssetNote, told Cybersecurity Dive via email.
AssetNote researchers discovered suspicious behavior while investigating those vulnerabilities, even in networks where the flaws had been patched.
Palo Alto Networks last week warned in an advisory that CVE-2025-0108 could allow an unauthenticated attacker with network access to the PAN-OS management web interface to bypass authentication and invoke certain PHP scripts.
Researchers at GreyNoise identified 25 unique IPs with malicious intent, according to a spokesperson there.
