CVE-2025-0115

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files.

The attacker must have network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. You can greatly reduce the risk of this issue by restricting access to the management interface to only trusted users and internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access.

Metrics

CVSS 4.0 6.8/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber

Weakness enumeration

CWE-41

Affected software

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	>= 11.2.0, < 11.2.3; >= 11.1.0, < 11.1.5; >= 11.0.0, < 11.0.6; >= 10.2.0, < 10.2.11; >= 10.1.0, < 10.1.14-h11
Palo Alto Networks	Cloud NGFW	—
Palo Alto Networks	Prisma Access	—

References

https://security.paloaltonetworks.com/CVE-2025-0115

Timeline

Published: Mar 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-01166.8A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a s CVE-2025-01177.1A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticate CVE-2025-01188.0A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context o CVE-2025-01196.3A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS comma CVE-2025-01207.0A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authe CVE-2025-01216.8A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Window CVE-2025-01225.1A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network ad CVE-2025-01235.9A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the pac CVE-2025-01243.8An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network acces CVE-2025-01256.9An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a maliciou CVE-2025-01268.3When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate aut CVE-2025-01277.1A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restriction