3.8

CVE-2025-0124

Medienbericht

PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files.

The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Paloaltonetworks ≫ Pan-os Version >= 10.1.0 < 10.1.14
Paloaltonetworks ≫ Pan-os Version >= 10.2.0 < 10.2.10
Paloaltonetworks ≫ Pan-os Version >= 11.0.0 < 11.0.6
Paloaltonetworks ≫ Pan-os Version >= 11.1.0 < 11.1.5
Paloaltonetworks ≫ Pan-os Version >= 11.2.0 < 11.2.1
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update -
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h1
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h10
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h2
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h3
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h4
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h5
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h6
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h7
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h8
Paloaltonetworks ≫ Pan-os Version 10.1.14 Update h9
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.25
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.8 1.2 2.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
psirt@paloaltonetworks.com 5.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber
CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
09.08.2025 11:36
https://security.paloaltonetworks.com/CVE-2025-0124
Vendor Advisory