CVE-2025-0108

criticalKEV · exploitedEPSS 0.985 · 100 %ileexploit · PoCDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 7 exploits · PoC

Likely / severe?

98.5% (100th) EPSS

CVSS 9.1 · critical

Is it mine?

37 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-02-18remediate by 2025-03-11

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-18

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRUGGEDCOM APE1808siemens_psirt
Upgrade Palo Alto Networks Virtual NGFW V11.1.8. Contact customer support to receive patch and update information
FixedRUGGEDCOM APE1808cisa_csaf_ot
Upgrade Palo Alto Networks Virtual NGFW V11.1.8. Contact customer support to receive patch and update information
MitigationRUGGEDCOM APE1808siemens_psirt
Exposure can be reduced by limiting access to the management interface to trusted internal IP addresses as described in Palo Alto Networks' Security Advisory
MitigationRUGGEDCOM APE1808cisa_csaf_ot
Exposure can be reduced by limiting access to the management interface to trusted internal IP addresses as described in Palo Alto Networks' Security Advisory

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.2–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · CISA US

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · Siemens ProductCERT DE

v3.18.2highAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · FSTEC (BDU) RU

v4.08.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Redsecondary · ENISA EU

v4.08.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Redsecondary · psirt@paloaltonetworks.com

v4.08.8highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Redsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USprimaryCWE-306USCWE-306USCWE-306US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (7)

Public proof-of-concept and weaponised exploit code.

FOLKS-iwd/CVE-2025-0108-PoCPoC exploit for CVE-2025-0108 - PAN-OS Authentication BypassPoC · poc_in_github
barcrange/CVE-2025-0108-Authentication-Bypass-checkerbarcrange/CVE-2025-0108-Authentication-Bypass-checkerPoC · poc_in_github
becrevex/CVE-2025-0108NSE script that checks for CVE-2025-0108 vulnerability in Palo Alto Networks PAN-OSPoC · poc_in_github
fr4nc1stein/CVE-2025-0108-SCAN Detects an authentication bypass vulnerability in Palo Alto PAN-OS (CVE-2025-0108).PoC · poc_in_github
iSee857/CVE-2025-0108-PoCPalo Alto Networks PAN-OS 身份验证绕过漏洞批量检测脚本(CVE-2025-0108)PoC · poc_in_github
kso4more/CVE-2025-0108kso4more/CVE-2025-0108PoC · poc_in_github

affected products (37)

Products and version ranges known to be affected.

PaloAlto Networks PAN-OS <10.1.14-h9all versionscert_bundDE
PaloAlto Networks PAN-OS <10.2.13-h3all versionscert_bundDE
PaloAlto Networks PAN-OS <11.1.6-h1all versionscert_bundDE
PaloAlto Networks PAN-OS <11.2.4-h4all versionscert_bundDE
Palo Alto Networks PAN-OS< 10.1.14-h9cert_bundDE
Palo Alto Networks PAN-OS< 10.2.13-h3cert_bundDE
Palo Alto Networks PAN-OS< 11.1.6-h1cert_bundDE
Palo Alto Networks PAN-OS< 11.2.4-h4cert_bundDE
RUGGEDCOM APE1808all versionscisa_csaf_otUS
Siemens RUGGEDCOM APE1808≤ vers:all/*cisa_csaf_otUS
Palo Alto Networks PAN-OS10.1.0 → 10.1.14-h9enisa_euvdEU
Palo Alto Networks PAN-OS10.2.0 → 10.2.7-h24enisa_euvdEU
Palo Alto Networks PAN-OS11.1.0 → 11.1.6-h1enisa_euvdEU
Palo Alto Networks PAN-OS11.2.0 → 11.2.4-h4enisa_euvdEU
Palo Alto Networks Inc. PAN-OS≤ 11.2.4-h4fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 10.1.14-h9fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 10.2.13-h3fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 11.1.6-h1fstec_bduRU
paloaltonetworks pan-os10.1.0 → 10.1.14nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.1.14nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

showing 20 of 37

advisories (3)

Vendor and ecosystem advisories describing this.

SSA-354569SSA-354569: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices2024-11-22csaf · siemens_psirtDE
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/
WID-SEC-W-2025-0361PaloAlto Networks PAN-OS: Mehrere SchwachstellenDeutsch2025-02-12csaf · cert_bundDE
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in PaloAlto Networks PAN-OS ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, Daten zu manipulieren und beliebigen Code auszuführen.
ICSA-24-338-02Siemens RUGGEDCOM APE18082024-11-22icsa · cisa_csaf_otUS
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/