CVE-2025-0111: Palo Alto PAN-OS authenticated file read, chained to root
The short version: CVE-2025-0111 is an authenticated file-read flaw in the PAN-OS management web interface — an attacker with a network-reachable session can read files accessible to the low-privileged "nobody" account. On its own it's a modest information-disclosure bug, but Palo Alto has observed it chained with CVE-2025-0108 (auth bypass) and CVE-2024-9474 (privilege escalation) to reach root on exposed firewalls. It's in CISA's KEV catalog. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice, as a chain link to root (see below) |
| CVSS v3.1 (NVD) | 6.5 — Medium · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CVSS (Palo Alto) | 7.1 — High |
| EPSS | ~1.93% · 77.68th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2025-03-13 |
| Known exploited? | Yes — chained with CVE-2025-0108 and CVE-2024-9474 in the wild |
| Vulnerability type | CWE-610 externally controlled reference to a resource → authenticated arbitrary file read |
| Requires authenticated session? | Yes — requires a session on the management web interface (low privilege) |
| Affected | PAN-OS 10.1 < 10.1.14, 10.2 < 10.2.7, 11.1, and 11.2 < 11.2.4 (management web interface) |
| Fixed in | PAN-OS 10.1.14-h9 · 10.2.13-h3 (and other 10.2 hotfixes) · 11.1.6-h1 · 11.2.4-h4 / 11.2.5 (and later) |
What you need to know
CVE-2025-0111 lets an authenticated attacker with access to the PAN-OS management web interface read files on the firewall's file system that are reachable by the low-privileged "nobody" account. By itself, that's a bounded information-disclosure issue — it needs a session and it doesn't grant code execution.
The reason it matters more than the base score suggests is the chain:
- CVE-2025-0108 provides the unauthenticated bypass to reach the interface, then
- CVE-2025-0111 reads sensitive files, and
- CVE-2024-9474 escalates to root.
Together they turn "reach the interface" into "own the firewall," and Palo Alto observed exactly this in the wild.
How serious we see it
High — in practice.
Standalone, this is a Medium (NVD 6.5; Palo Alto 7.1): authenticated, confidentiality-only. But it is confirmed exploited as part of a root-level chain and is KEV-listed, so we rate it by how it's actually used, not by the isolated metric — the same reasoning we apply whenever a "small" bug is the middle link in a full compromise. The bounded, reassuring part: it affects specific PAN-OS builds, fixes are published, and keeping the management interface off the internet removes the exposure that makes the chain reachable.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Patch now. Upgrade to a fixed PAN-OS build (e.g. 10.1.14-h9 / 10.2.13-h3 / 11.1.6-h1 / 11.2.4-h4 or later).
- Restrict the management interface to trusted internal IPs. This closes the door the chain depends on.
- Hunt for the chain. Review logs for CVE-2025-0108 → CVE-2025-0111 → CVE-2024-9474 activity.
- If compromised, respond fully. Rebuild where warranted and rotate all credentials, keys, and certificates on the device.
- Confirm your exposure first. Verify whether an affected PAN-OS management interface is reachable at all.
How BreachRisk sees it
BreachRisk discovers internet-facing PAN-OS management interfaces from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top because it's part of an in-the-wild root chain.
That continuous, outside-in view is the point: the exposed interface is already mapped, so you can go straight to patch-and-verify rather than discovering the chain after the fact.