{"basis":"claimed","id":"CVE-2025-0108","name":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","vendorProject":"Palo Alto Networks","product":"PAN-OS","publishedAt":"2025-02-12","cvss":{"score":8.8,"severity":"HIGH","version":"4.0"},"exploited":{"kevAdded":"2025-02-18","dueDate":"2025-03-11","ransomware":false},"epss":{"score":0.98455,"percentile":0.99919,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-02-24","daysToRule":12},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-03-11","daysToRule":27},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"PAN-OS: Authentication Bypass in the Management Web Interface","description":"An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.\n\nYou can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue does not affect Cloud NGFW or Prisma Access software.","cwes":["CWE-306"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-02-24","firstIsNew":true,"daysToRule":12,"daysAtMost":null,"freePlan":false,"claims":[{"id":"4df5cc61d8861734c66cdba774e23181921d6164a28b4897e741306fb33376e0","cve_id":"CVE-2025-0108","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"77c13c611d2a4fa3a89c0fafc382fdec","rule_name":"Palo Alto Networks - Auth Bypass - CVE:CVE-2025-0108","change":"new","default_action":"Block","published_on":"2025-02-24","source_url":"https://developers.cloudflare.com/changelog/post/2025-02-24-waf-release/","source_title":"WAF Release - 2025-02-24","excerpt":"Palo Alto Networks - Auth Bypass - CVE:CVE-2025-0108. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.759Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-03-11","firstIsNew":true,"daysToRule":27,"daysAtMost":null,"freePlan":false,"claims":[{"id":"3b7ac680b2c096a2c5e170cf85c8bad3f922832930009dd95dc75c445679d9a2","cve_id":"CVE-2025-0108","vendor":"f5","product":"Attack signatures","rule_id":"200013108","rule_name":"Palo Alto PAN-OS Management Web Authentication Bypass (3)","change":"new","default_action":null,"published_on":"2025-03-11","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200013108 \"Palo Alto PAN-OS Management Web Authentication Bypass (3)\" (Authentication/Authorization Attacks, risk High), systems: PHP, Other Web Server, Proxy Servers. References: CVE-2025-0108.","first_seen_at":"2026-11-02T21:00:26.672Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:42.096Z","cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"partial"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2025-0108","templatePath":"http/cves/2025/CVE-2025-0108.yaml","requests":1,"blockedRequests":1,"rules":["930100"],"note":"","requestDetail":[{"method":"GET","path":"/unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css","status":403,"blocked":true,"rules":["930100"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2025-0108","templatePath":"http/cves/2025/CVE-2025-0108.yaml","requests":1,"blockedRequests":1,"rules":["930100"],"note":"","requestDetail":[{"method":"GET","path":"/unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css","status":403,"blocked":true,"rules":["930100"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}