Palo Alto Networks Patches Potentially Serious Firewall Vulnerability

February 19, 2025

Palo Alto Networks has issued urgent warnings as cybersecurity researchers observe threat actors exploiting a combination of vulnerabilities in PAN-OS, the operating system powering its next-generation firewalls.

Coordinated attacks, which bypass chain authentication and privilege escalation flaws, enable unauthorized access to unpatched devices, posing severe risks to enterprise network integrity.

The primary vulnerability under active exploitation, CVE-2025-0108, is an authentication bypass flaw in PAN-OS’s management web interface.

Discovered by Assetnote researchers and disclosed on February 12, 2025, it allows unauthenticated attackers to execute specific PHP scripts, compromising system confidentiality and integrity.

While this vulnerability alone does not permit remote code execution, its exploitation surged within 24 hours of disclosure, with GreyNoise tracking 25 malicious IPs by February 18.

Hackers Chaining Multiple Palo Alto Vulnerabilities

Palo Alto Networks confirmed attackers are chaining CVE-2025-0108 with two additional vulnerabilities:

• CVE-2024-9474: A privilege escalation flaw (CVSS 6.9) enabling authenticated administrators to execute root-level commands. Actively exploited since November 2024, it has been linked to cryptojacking, webshell deployments, and sensitive data exfiltration.
• CVE-2025-0111: A medium-severity file read vulnerability (CVSS 4.9) allowing authenticated users to access files readable by the “nobody” account.

By combining these vulnerabilities, attackers bypass authentication, escalate privileges, and extract critical system files, achieving full root access to firewalls.

This exploitation trend mirrors previous campaigns targeting Palo Alto devices. In November 2024, attackers chained CVE-2024-0012 (authentication bypass) with CVE-2024-9474 to deploy cryptominers and command-and-control implants.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) noted over 2,000 compromised instances globally during that campaign.

Arctic Wolf observed attackers exfiltrating firewall configurations containing credentials for lateral movement, while Darktrace identified post-exploitation activities like reconnaissance and cryptomining.

Full Article