CVE-2025-0111PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

7.1 HIGHEPSS 1.99%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 08:25 UTC

OverviewCVSS details

7.1HIGHCVSS 4.0

Score source: palo_alto (CNA)
NVD status: Analyzed
Published: Feb 12, 2025
Assigner: palo_alto

Affected

Cloud NGFW (Palo Alto Networks)

+2 more products →

Exploitation

Public exploit: None listed
CISA KEV: Listed · Feb 20, 2025
KEV due date: Mar 13, 2025
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact partial

EPSS · FIRST, scored Nov 8

1.99%chance of exploitation in 30 days

Higher than 80.87% of CVEs

CVSS 4.0 · palo_alto (CNA)

7.1High

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality impact: High
Integrity impact: None
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 4.0 · palo_alto (CNA)

5.9Medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: High
User interaction: None
Confidentiality impact: High
Integrity impact: None
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

6.5Medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.1	HIGH	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red
5.9	MEDIUM	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber
6.5	MEDIUM	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA required action

⚡ Known exploited · remediation due Mar 13, 2025

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2025-0111
Status: Analyzed
Assigner (CNA): palo_alto
Published: Feb 12, 2025
Last modified: 2026-06-17 08:25 UTC
Weaknesses: CWE-73 · External Control of File Name or Path
CWE-610

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 13:15 UTC.