- Palo Alto Networks fixes approval of bypass-Pan-OS Error
- One day after the patch was released, criminals began to look for vulnerable endpoints
- The error allows them to run different PHP scripts
A vulnerability in Palo Alto Networks Firewalls is abused in attacks on the wild ones, researchers say.
The company recently found and fixed an approval compass vulnerability in its Pan-Os-Firewalls. The error traced as CVE-2025-0108 has a severity of 8.8/10 (high) and is said to affect several versions of the product.
It released a solution on February 12, 2025 and urged users to upgrade their firewalls to these versions:
11.2.4-H4 or newer
11.1.6-H1 or newer
10.2.13-H3 or newer
10.1.14-H9 or newer
Take advantage of attempts
Vulnerability affects the Pan-OS control web interface and allows malicious actors to run different PHP scripts. This, on its part, enables sensitive data exfiltration, firewall configuration manipulation and more.
Now, scientists from Security Outlet Greynoise said they observed attempts to exploit the mistake of non -trial end points. The attacks, they said, started a day after Palo Alto Networks released Patch (February 13) and came from several IP addresses, which might suggest that several attackers picked up the vulnerability at the same time.
With reference to information from Macnica -Scientist Yutaka Sejiyama, Bleeping computer reported that the attack surface is likely to count more than 4,400 units.
To protect firewalls, users must use the patch as soon as possible and limit access to the product’s interface as soon as possible.
Firewalls used by SMBs are often targets because these types of companies typically have weaker security configurations and outdated firmware. Many SMBs lack dedicated IT teams, leading to incorrectly configured firewall rules that create vulnerabilities. In addition, threat players can use firewalls as entry points to bypass network defense and gain deeper access to internal systems. Once compromised, firewalls can be used to intercept sensitive data, start additional attacks or disable security measures completely.
Via Bleeping computer
