Hackers gain root access to Palo Alto firewalls through chained bugs – Source: www.csoonline.com

A high-severity authentication bypass vulnerability in Palo Alto Networks’ PAN-OS software, patched last week, is now being actively exploited by threat actors to gain root-level access to affected firewall systems.

Tracked as CVE-2025-0108, the vulnerability allows an unauthenticated attacker with network access to the PAN-OS management web interface to bypass authentication requirements.

The flaw received a severity rating of CVSS 8.8 out of 10, but only when access to the management web interface from external IP addresses on the internet is allowed. The rating is significantly reduced to 5.9 when this access is restricted to allowed IP addresses, making it an effective workaround.

The bypass allows attackers to invoke certain PHP scripts which, while may not enable remote code execution, can “negatively impact integrity and confidentiality of PAN-OS”, Palo Alto had said in a security advisory.

Chaining with older flaws for root-level compromise

The exploitation involves chaining CVE-2025-0108 with two older flaws, one with prior active exploitation, that allow privilege escalation and authenticated file read on affected systems.

“Palo Alto Networks has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and unsecured PAN-OS web management interfaces,” according to an update made on the advisory.

Discovery of CVE-2025-0108 came from post-patch analysis of CVE-2024-9474, a medium-severity flaw (CVSS 6.9/10) that was actively exploited in November. At that time, attackers were seen chaining CVE-2024-9474 with another critical authentication bypass vulnerability (CVE-2024-0012) affecting PAN-OS, and together they allowed executing codes remotely on compromised systems.

Now threat actors are chaining CVE-2025-0108, and CVE-2024-9474 with a high-severity flaw (CVE-2025-0111) for unauthorized root-level access to vulnerable systems, potentially allowing extraction of sensitive configuration data and user credentials.

All three vulnerabilities affect PAN-OS versions 10.1, 10.2, 11.1, and 11.2, and have received patches respectively. Palo Alto Networks confirmed that its Cloud NGFW and Prisma Access services are not impacted.

As a workaround, admins are advised to restrict access to the management web interface to only trusted internal IP addresses. Even then, unpatched systems may remain vulnerable with reduced risks. Additionally, customers with a Threat Prevention subscription could block attack attempts looking to exploit CVE-2025-0108 and CVE-2025-0111 by enabling Threat ID 510000 ad 510001, the advisory added.