PAN-OS - Authentication Bypass (CVE-2025-0108)
Description
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts.
psychologyCrowdSec Analysis
CVE-2025-0108 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS that allows unauthenticated attackers with network access to the management web interface to bypass required authentication and invoke internal PHP scripts.
CrowdSec has been tracking this vulnerability and its exploits since 18th of February 2025.
CrowdSec network data shows that most actors exploiting CVE-2025-0108 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2025-0108 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Exploitation attempts frequently target URLs containing the pattern /unauth/%252e%252e/.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-02-12 |
| Rule Released | 2025-02-18 |
| CISA KEV | 2025-02-18 |
| CrowdSec First Seen | 2025-02-19 |
| CISA Remediation Deadline | 2025-03-11 |