CVE-2025-0108

criticalKEV · ausgenutztEPSS 0.985 · 100. PerzentilExploit · PoCDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 7 exploits · PoC

Likely / severe?

98.5% (100th) EPSS

CVSS 9.1 · critical

Is it mine?

37 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

hinzugefügt 2025-02-18beheben bis 2025-03-11

erforderliche Maßnahme Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · bewertet 2026-10-18

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenRUGGEDCOM APE1808siemens_psirt
Upgrade Palo Alto Networks Virtual NGFW V11.1.8. Contact customer support to receive patch and update information
BehobenRUGGEDCOM APE1808cisa_csaf_ot
Upgrade Palo Alto Networks Virtual NGFW V11.1.8. Contact customer support to receive patch and update information
MitigationRUGGEDCOM APE1808siemens_psirt
Exposure can be reduced by limiting access to the management interface to trusted internal IP addresses as described in Palo Alto Networks' Security Advisory
MitigationRUGGEDCOM APE1808cisa_csaf_ot
Exposure can be reduced by limiting access to the management interface to trusted internal IP addresses as described in Palo Alto Networks' Security Advisory

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.2–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.2

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · CISA US

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · Siemens ProductCERT DE

v3.18.2highAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · FSTEC (BDU) RU

v4.08.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Redsecondary · ENISA EU

v4.08.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Redsecondary · psirt@paloaltonetworks.com

v4.08.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Redsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-306USprimärCWE-306USCWE-306USCWE-306US

ATT&CK-Techniken

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

Exploits (7)

Öffentlicher Proof-of-Concept- und Exploit-Code.

FOLKS-iwd/CVE-2025-0108-PoCPoC exploit for CVE-2025-0108 - PAN-OS Authentication BypassPoC · poc_in_github
barcrange/CVE-2025-0108-Authentication-Bypass-checkerbarcrange/CVE-2025-0108-Authentication-Bypass-checkerPoC · poc_in_github
becrevex/CVE-2025-0108NSE script that checks for CVE-2025-0108 vulnerability in Palo Alto Networks PAN-OSPoC · poc_in_github
fr4nc1stein/CVE-2025-0108-SCAN Detects an authentication bypass vulnerability in Palo Alto PAN-OS (CVE-2025-0108).PoC · poc_in_github
iSee857/CVE-2025-0108-PoCPalo Alto Networks PAN-OS 身份验证绕过漏洞批量检测脚本(CVE-2025-0108)PoC · poc_in_github
kso4more/CVE-2025-0108kso4more/CVE-2025-0108PoC · poc_in_github

betroffene Produkte (37)

Betroffene Produkte und Versionsbereiche.

PaloAlto Networks PAN-OS <10.1.14-h9alle Versionencert_bundDE
PaloAlto Networks PAN-OS <10.2.13-h3alle Versionencert_bundDE
PaloAlto Networks PAN-OS <11.1.6-h1alle Versionencert_bundDE
PaloAlto Networks PAN-OS <11.2.4-h4alle Versionencert_bundDE
Palo Alto Networks PAN-OS< 10.1.14-h9cert_bundDE
Palo Alto Networks PAN-OS< 10.2.13-h3cert_bundDE
Palo Alto Networks PAN-OS< 11.1.6-h1cert_bundDE
Palo Alto Networks PAN-OS< 11.2.4-h4cert_bundDE
RUGGEDCOM APE1808alle Versionencisa_csaf_otUS
Siemens RUGGEDCOM APE1808≤ vers:all/*cisa_csaf_otUS
Palo Alto Networks PAN-OS10.1.0 → 10.1.14-h9enisa_euvdEU
Palo Alto Networks PAN-OS10.2.0 → 10.2.7-h24enisa_euvdEU
Palo Alto Networks PAN-OS11.1.0 → 11.1.6-h1enisa_euvdEU
Palo Alto Networks PAN-OS11.2.0 → 11.2.4-h4enisa_euvdEU
Palo Alto Networks Inc. PAN-OS≤ 11.2.4-h4fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 10.1.14-h9fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 10.2.13-h3fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 11.1.6-h1fstec_bduRU
paloaltonetworks pan-os10.1.0 → 10.1.14nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.1.14nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

20 von 37 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-354569SSA-354569: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices2024-11-22csaf · siemens_psirtDE
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/
WID-SEC-W-2025-0361PaloAlto Networks PAN-OS: Mehrere SchwachstellenDeutsch2025-02-12csaf · cert_bundDE
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in PaloAlto Networks PAN-OS ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, Daten zu manipulieren und beliebigen Code auszuführen.
ICSA-24-338-02Siemens RUGGEDCOM APE18082024-11-22icsa · cisa_csaf_otUS
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/