PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
- Sévérité
- Moyenne6,5CVSS 3.1, Moyenne
- EPSS
- 2 %
- Publiée
- 12 févr. 2025
- Mise à jour
- 17 juin 2026
Description
Le titre, la description et les consignes de l’éditeur sont cités depuis les enregistrements sources (en anglais).
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
Faiblesse : CWE-73, CWE-610
Exploitée activement
Ajoutée au catalogue CISA KEV le 20 févr. 2025
Date limite de remédiation fédérale : 13 mars 2025
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Prédiction d’exploitation
Probabilité d’exploitation de 2 % dans les 30 prochains jours (percentile 80 %).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ce qu’indique la source, par branche
Versions comparées par Patcharo
Palo Alto Networks PAN-OSSource : Palo Alto Networks (CVE record)
| Branche | Affectées | Corrigé en |
|---|---|---|
| 11.2 | >= 11.2.0, < 11.2.4-h4 | 11.2.4-h4 |
| 11.1 | >= 11.1.0, < 11.1.2-h18 >= 11.1.3, < 11.1.6-h1 | 11.1.2-h18 11.1.6-h1 |
| 10.2 | >= 10.2.0, < 10.2.7-h24 >= 10.2.8, < 10.2.8-h21 >= 10.2.9, < 10.2.9-h21 >= 10.2.10, < 10.2.10-h14 >= 10.2.11, < 10.2.11-h12 >= 10.2.12, < 10.2.12-h6 >= 10.2.13, < 10.2.13-h3 | 10.2.7-h24 10.2.8-h21 10.2.9-h21 10.2.10-h14 10.2.11-h12 10.2.12-h6 10.2.13-h3 |
| 10.1 | >= 10.1.0, < 10.1.14-h9 | 10.1.14-h9 |
Selon l’éditeur, les versions non listées ne sont pas affectées.
Contournement / Remédiation de l’éditeur
Contournement · PAN-OS
Recommended mitigation—The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 * Palo Alto Networks official and detailed technical documentation: https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices Additionally, customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510000 and 510001 (introduced in Applications and Threats content version 8943). https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-…
Remédiation de l’éditeur · PAN-OS
Version Minor Version Suggested Solution PAN-OS 10.1 10.1.0 through 10.1.14 Upgrade to 10.1.14-h9 or later PAN-OS 10.2 10.2.0 through 10.2.13 Upgrade to 10.2.13-h3 or later 10.2.7Upgrade to 10.2.7-h24 or 10.2.13-h3 or later 10.2.8Upgrade to 10.2.8-h21 or 10.2.13-h3 or later 10.2.9Upgrade to 10.2.9-h21 or 10.2.13-h3 or later 10.2.10Upgrade to 10.2.10-h14 or 10.2.13-h3 or later 10.2.11Upgrade to 10.2.11-h12 or 10.2.13-h3 or later 10.2.12Upgrade to 10.2.12-h6 or 10.2.13-h3 or later PAN-OS 11.0 (EoL) Upgrade to a supported fixed versionPAN-OS 11.1 11.1.0 through 11.1.6 Upgrade to 11.1.6-h1 or later 11.1.2Upgrade to 11.1.2-h18 or 11.1.6-h1 or later PAN-OS 11.2 11.2.0 through 11.2.4 Upgrade to 11.2.4-h4 or laterNote: PAN-OS 11.0 reached end of life (EoL) on November 17, 2024. No additional fixes are planned for this release.
Références
Provenance
Chaque information de cette page provient des sources ci-dessous. Rien n’est rédigé par une IA.
- Palo Alto Networks (CVE record)
- Palo Alto Networks (CVE record) · 27 sept. 2026, 23:46 UTC · Analyseur patcharo-cve5/1.1.0
- CISA Known Exploited Vulnerabilities
- CISA Known Exploited Vulnerabilities · 27 sept. 2026, 23:42 UTC · Analyseur patcharo-kev/1.0.0
- NVD
- NVD · 27 sept. 2026, 23:44 UTC · Analyseur patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 27 sept. 2026, 23:46 UTC · Analyseur patcharo-epss/1.0.0
Dernière vérification : 28 sept. 2026, 02:31 UTC