- Palo Alto Networks warns of an ongoing attack on its firewalls
- The threat actors are linking more missing together
- The goal is to download configuration files
Palo Alto Networks has warned its users of a continuous attack that links several vulnerabilities to download configuration files and other sensitive information.
CyberSecurity Company warned its users about CVE-2025-0111, a 7.1/10 (high-swarming) file Read vulnerability that plagues Pan-O-Firewalls. This error allows an approved striker with network access to access the administration web interface and read files that are usually read by the “None” user.
The error was determined on February 12, 2025, when Palo Alto released a solution and encouraged users to use it.
Derivation
On the same day, the company treated a separate vulnerability that was traced as CVE-2025-0108. This one is an approval compass in Pan-OS that enables a non-approved striker with network access to the web interface to bypass the approval otherwise required by Pan-OS interface, and proclaim some PHP scripts.
Finally, in mid-November 2024, Palo Alto got a privilege scaling error traced as CVE-2014-9474. Now, scientists say these three are tied together in running attacks.
“Palo Alto Networks has observed utilization attempts to link CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on non-sent and unsecured Pan-OS web blades,” it is said in security advice.
The company did not discuss the details of the attack but Bleeping computer found that they are used to download configuration files and other sensitive information.
So far, at least 25 different IP addresses were observed targeted CVE-2025-0108, up from only two a week ago. The top sources of the attacks appear to be the United States, Germany and the Netherlands, although this does not necessarily mean that the threat actors are located there.
While society rushes to apply the patch and mitigate potential risks, US cyber security and infrastructure security agency (CISA) have added CVE-2025-0108 to its ‘known utilized vulnerabilities’ (KEV) catalog, giving users until 11 March to PATCH UP .
