Palo Alto Networks warns that a file read error (CVE-2025-0111) is now being combined with two other vulnerabilities (CVE-2025-0108 and CVE-2024-9474) to compromise PAN-OS firewalls in active attacks.
See also: Hackers exploit vulnerability in Palo Alto firewalls
The vendor first announced the authentication bypass vulnerability, known as CVE-2025-0108, on February 12, 2025, along with the release of patches to address it. On the same day, Assetnote published a proof-of-concept exploit that demonstrates how the CVE-2025-0108 and CVE-2024-9474 can be combined to allow root on unpatched PAN-OS firewalls.
A day later, cyber threat analysis firm GreyNoise announced that malicious actors had already begun actively exploiting the security vulnerabilities, with the attacks originating from two specific IP addresses.
CVE-2024-9474 is a serious privilege escalation flaw in PAN-OS, which was patched in November 2024. The vulnerability allows a PAN-OS administrator to execute root commands on firewalls. In its announcement, Palo Alto Networks noted that the firewall flaw was exploited as a zero-day, underscoring its severity.
See also: Palo Alto Networks fixes vulnerability in PAN-OS Software
CVE -2025-0111 is a file read vulnerability in PAN-OS. This vulnerability allows attackers with network access via the management web interface to read files that are accessible by the “nobody” user.
The flaw, CVE-2025-0111, was patched on February 12, 2025. However, the vendor today updated its bulletin, warning that the specific flaw is now being used in combination with two others, in active exploit chains during attacks.
Although Palo Alto Networks has not disclosed details about the exploit chain abuse, BleepingComputer has been informed that the firewall flaws could be combined, allowing access to configuration files and other sensitive information.
See also: Over 2,000 Palo Alto firewalls compromised via zero-day
Firewall errors can pose significant risks to the security of networks and systems. These flaws can result from misconfigurations, outdated software, or flaws in the firewall code. By exploiting these errors, attackers may be able to bypass security restrictions, gaining unauthorized access to sensitive data or systems. Regular updates, thorough testing, and proper configuration are essential to minimize such risks. Early identification and repair of firewall errors can help ensure network integrity and prevent potential breaches.
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
