{"id":"CVE-2025-0111","kind":"vulnerability","aliases":["CVE-2025-0111"],"related":[],"title":"paloaltonetworks pan-os: An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker…","description":"An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.\n\nYou can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue does not affect Cloud NGFW or Prisma Access software.","summary":"Palo Alto Networks PAN-OS, the firewall operating system, has a file read flaw in its management web interface. An attacker with valid login to that interface can read files the nobody user can access on the device.","severity":"high","cvss":7.1,"epss":null,"exploited":true,"exploited_at":"2025-02-20T00:00:00+00:00","products":[{"name":"Palo Alto Networks PAN-OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["10.1.14"],"affected":">= 10.1.0, < 10.1.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["10.2.7"],"affected":">= 10.2.0, < 10.2.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["10.2.12"],"affected":">= 10.2.10, < 10.2.12","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["11.1.6"],"affected":">= 11.0.0, < 11.1.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["11.2.4"],"affected":">= 11.2.0, < 11.2.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.1.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.8","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.9","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.12","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.13","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewalls","infrastructure","palo-alto","pan-os","self-hosted"],"not_affected_if":["auth-required","no-management-interface-exposure"],"how_to_check":null,"fix":"Apply the mitigations or fixed PAN-OS release per the vendor advisory; if none are available, discontinue use of the product per CISA. Affected and fixed versions: unknown from sources.","status":"open","published_at":"2025-02-12T21:15:16+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:24+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:52:24Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations or fixed PAN-OS release per the vendor advisory; if none are available, discontinue use of the product per CISA. Affected and fixed versions: unknown from sources.","reach":"network","impact":"medium","summary":"Palo Alto Networks PAN-OS, the firewall operating system, has a file read flaw in its management web interface. An attacker with valid login to that interface can read files the nobody user can access on the device.","category":"infrastructure","who_cares":["palo-alto","pan-os","firewalls","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads device files readable by nobody user","analyst_note":"Find affected and fixed PAN-OS versions and mitigation steps in the Palo Alto Networks advisory for CVE-2025-0111 (linked from the KEV entry); confirm which files are exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-management-interface-exposure","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2670,"output_tokens":392,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0111':25A,28A '-2025':24A,27A '/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431':213C 'access':134B,158C,191C,223C 'accord':203C 'address':202C 'affect':218C 'alto':13A,30A,92B,100B,146C 'attack':22A,120B,155C 'authent':6A,21A,139C,154C 'best':207C 'cloud':219C 'cve':23A,26A 'deploy':209C 'devic':137B 'enabl':19A,152C 'exploit':87B 'file':7A,111B,129B,140C,166C 'filesystem':172C 'firewal':88B,106B 'flaw':113B 'great':182C 'guidelin':210C 'host':98B 'infrastructur':89B 'interfac':118B,126B,163C,196C 'intern':200C 'ip':201C 'issu':188C,215C 'live.paloaltonetworks.com':212C 'live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431':211C 'login':123B 'manag':116B,161C,194C 'network':14A,101B,147C,157C 'networks':31A 'ngfw':220C 'nobodi':131B,178C 'oper':107B 'os':4A,17A,34A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A,78A,82A,86A,95B,104B,150C,171C 'palo':12A,29A,91B,99B,145C 'palo-alto':90B 'paloaltonetwork':1A 'paloaltonetworks':35A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A 'pan':3A,16A,33A,37A,41A,45A,49A,53A,57A,61A,65A,69A,73A,77A,81A,85A,94B,103B,149C,170C 'pan-o':2A,15A,93B,102B,148C,169C 'pan-os':32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,84A 'practic':208C 'prisma':222C 'read':8A,112B,128B,141C,165C 'readabl':175C 'recommend':206C 'reduc':183C 'restrict':190C 'risk':185C 'self':97B 'self-host':96B 'softwar':18A,151C,224C 'system':108B 'trust':199C 'user':132B,179C 'valid':122B 'vulner':9A,142C 'web':117B,162C,195C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-02-12T21:15:16+00:00","kev":{"dateAdded":"2025-02-20","dueDate":"2025-03-13","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Red","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-0111","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0111","severity":null,"published_at":"2025-02-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-0111","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0111","severity":null,"published_at":"2025-02-12T21:15:16+00:00","modified_at":"2026-06-17T08:25:51+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}