Palo Alto Networks has issued urgent warnings as cybersecurity researchers observe threat actors exploiting a combination of vulnerabilities in PAN-OS, the operating system powering its next-generation firewalls. By combining these vulnerabilities, attackers bypass authentication, escalate privileges, and extract critical system files, achieving full root access to firewalls. Coordinated attacks, which bypass chain authentication and privilege escalation flaws, enable unauthorized access to unpatched devices, posing severe risks to enterprise network integrity. Discovered by Assetnote researchers and disclosed on February 12, 2025, it allows unauthenticated attackers to execute specific PHP scripts, compromising system confidentiality and integrity. The recurring exploitation of Palo Alto vulnerabilities underscores the risks of internet-exposed management interfaces. Assetnote’s Shubham Shah highlighted that while CVE-2025-0108 requires chaining with other flaws, the prevalence of unpatched systems and public proof-of-concept exploits lowers the barrier for attackers. Steven Thai, a Palo Alto spokesperson, reiterated the criticality of timely updates: “The security of our customers remains our top priority. The primary vulnerability under active exploitation, CVE-2025-0108, is an authentication bypass flaw in PAN-OS’s management web interface. With Palo Alto firewalls securing 24% of enterprise cloud environments, proactive mitigation remains essential to thwart large-scale breaches. CISA added CVE-2025-0108 to its Known Exploited Vulnerabilities catalog on February 19, mandating federal agencies to remediate it by March 7, 2025. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. While this vulnerability alone does not permit remote code execution, its exploitation surged within 24 hours of disclosure, with GreyNoise tracking 25 malicious IPs by February 18. As of February 19, 2025, GreyNoise continues tracking exploit attempts, noting concentrated IPs from regions historically linked to state-sponsored and cybercriminal groups.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Feb 2025 14:35:05 +0000