CVE-2025-0108

What it actually does

CVE-2025-0108 is an authentication bypass in the PAN-OS management web interface. An unauthenticated attacker who can reach the management interface over the network can craft HTTP requests that bypass the normal web authentication requirement and invoke certain PHP scripts that should only be reachable after login. The vendor states this does not directly provide remote code execution, but it can compromise confidentiality and integrity of the management plane by exposing or manipulating management-interface functions that were intended to be authenticated. The highest-risk condition is an internet-exposed or broadly reachable PAN-OS management interface.

Why it matters to the business

This is a high-urgency perimeter-device vulnerability: it has a CVSS score of 9.1, a very high EPSS score of 0.98455, is listed in CISA KEV, and is reported as actively exploited in the wild. The KEV remediation deadline was 2025-03-11, so unremediated systems should be treated as overdue and potentially targeted. Successful exploitation can expose sensitive firewall management information, weaken trust in firewall configuration integrity, support follow-on attacks, and create operational risk for network security controls. Although the KEV record does not indicate known ransomware use, exploitation of firewall management interfaces is often valuable to attackers because these systems sit at network boundaries and may contain VPN, routing, policy, certificate, and administrative data.

How an attack unfolds

An attacker first identifies a PAN-OS management web interface that is reachable from their network position, commonly through internet scanning or access from a compromised internal host. They then send specially crafted HTTP or HTTPS requests to the management web interface that route through an unauthenticated path but resolve to PHP scripts normally protected by authentication. If the device is vulnerable, the request is processed without a valid management login session. The attacker can then enumerate which scripts are callable, collect information exposed by those scripts, and attempt integrity-impacting actions permitted by the reachable endpoints. In real intrusions, this flaw may be used as an initial management-plane foothold or chained with other PAN-OS weaknesses, credential theft, or misconfiguration to deepen access. Exploitation activity is publicly tracked and the vulnerability is in the CISA Known Exploited Vulnerabilities catalog, so exposed management interfaces should be assumed to be under active scanning.

How to fix it

Upgrade affected PAN-OS devices to a vendor-fixed PAN-OS release for the deployed software branch, following the Palo Alto Networks advisory for CVE-2025-0108. Because no exact fixed versions were provided in the input, verify the target release against the current vendor advisory before scheduling change windows. This issue does not affect Cloud NGFW or Prisma Access software. Independently of patching, restrict the PAN-OS management web interface to trusted administrative networks and trusted internal IP addresses only; do not expose it directly to the internet. Enforce management-plane access control lists, dedicated management networks or VPN access, strong administrative authentication, and logging. If immediate patching is not possible, prioritize network isolation of the management interface as a compensating control, then patch at the earliest feasible maintenance window. If exploitation is suspected, review configuration integrity, rotate administrative credentials and API keys as appropriate, and investigate for chained activity.

How to confirm the fix worked

Confirm every PAN-OS device version against the vendor advisory and verify it is running a fixed release for its branch. Validate from an untrusted network position that the management interface is not reachable except from explicitly approved administrative sources. Where safe and authorized, perform a non-invasive check against the management interface for known bypass-style paths, such as requests containing encoded traversal from an unauthenticated path to a PHP script, and confirm the device returns an authentication failure, 403, 404, or otherwise does not process the protected script. Review firewall, router, cloud security group, and management-plane ACLs to ensure only trusted administrative IP ranges can connect. After remediation, re-run external exposure scans and confirm there are no internet-facing PAN-OS management services.

Typical attack path

1. Scan for PAN-OS management web interfaces exposed to the internet or reachable from a compromised network segment.
2. Fingerprint the management service and confirm that it is a PAN-OS management web interface rather than Cloud NGFW or Prisma Access.
3. Send crafted unauthenticated HTTP requests that use encoded path traversal or alternate-path behavior to reach protected PHP scripts through an unauthenticated URL path.
4. Observe HTTP status codes, response bodies, redirects, or error behavior to determine whether authentication was bypassed.
5. Invoke reachable PHP scripts to obtain sensitive information or perform actions that affect management-plane confidentiality or integrity.
6. Use the obtained information or access to support follow-on activity, such as configuration reconnaissance, credential targeting, lateral movement planning, or chaining with additional vulnerabilities.

How to detect it

Investigate whether the PAN-OS management interface received unauthenticated requests attempting to reach PHP scripts through encoded or alternate paths. Prioritize web management access logs, reverse proxy logs, WAF logs, load balancer logs, firewall traffic logs, NetFlow, VPN logs, and PAN-OS system and configuration logs. Look for requests containing /unauth/ together with encoded traversal sequences such as %252e%252e, %2e%2e, ..%2f, or attempts to access /php/*.php without an established authenticated admin session. Pay particular attention to HTTP 200, 302, or unusual application responses for these requests, especially from unknown external IP addresses, scanning infrastructure, or sources that made many requests across multiple management endpoints. Correlate suspicious requests with subsequent administrator logins, configuration commits, API key activity, certificate or configuration exports, changes to local users, management-access policy changes, and unexpected system errors. If logs are limited on the device, use upstream network telemetry and packet metadata to identify HTTPS connections to management interfaces during the exposure window, then correlate source IPs with any available PAN-OS management events.

• /unauth/%252e%252e/php/
• /unauth/%2e%2e/php/
• /unauth/..%2fphp/
• /unauth/%252e%252e/php/ztp_gate.php
• GET /unauth/%252e%252e/php/
• POST /unauth/%252e%252e/php/
• /ztp_gate.php/PAN_help/x.css
• /PAN_help/x.css
• %252e%252e/php/
• %2e%2e/php/

What your security team should do

• Immediately inventory PAN-OS management interfaces and identify any that are internet-facing or reachable from broad internal networks.
• Patch all affected PAN-OS devices to vendor-fixed releases; treat remediation as overdue because the CISA KEV due date was 2025-03-11.
• Before or during patching, restrict management web access to trusted administrative IP addresses or a dedicated management VPN/network only.
• Hunt for prior exploitation in management web logs, upstream proxy/WAF logs, firewall traffic logs, and PAN-OS system/config logs using encoded traversal and unauthenticated PHP access patterns.
• Review recent PAN-OS configuration changes, administrator activity, API key usage, certificate exports, and unexpected management sessions for signs of unauthorized activity.
• If suspicious activity is found, rotate administrative credentials and API keys, validate firewall policy integrity, preserve logs, and investigate for chained exploitation or lateral movement.
• Add SIEM detections for requests to PAN-OS management interfaces containing /unauth/ combined with encoded traversal and /php/ script access.
• Ensure management interfaces are continuously monitored for exposure by external attack surface management or recurring internet-facing scans.