CVE-2025-0110

Year

2025

Published

Feb 12, 2025

Known Affected Devices

CVSS Score

N/A

What is CVE-2025-0110?

A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands. The commands are run as the “__openconfig” user (which has the Device Administrator role) on the firewall. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

Known Affected Devices

Palo Alto Networks Palo Alto PA-460 Palo Alto Networks Palo Alto PA-3220 Palo Alto Networks Palo Alto PA-3430 Palo Alto Networks Palo Alto PA-5260 Palo Alto Networks Palo Alto PA-5440 Palo Alto Networks Palo Alto VM-700 Palo Alto Networks Palo Alto Panorama M-500

FAQ

How severe is CVE-2025-0110?

CVE-2025-0110 has a CVSS score of N/A/10, rated as Unknown. Review the affected products list and apply vendor patches.

What does the CVSS score mean for CVE-2025-0110?

CVSS (Common Vulnerability Scoring System) rates vulnerability severity from 0.0 to 10.0. CVE-2025-0110 scores N/A/10 (Unknown). Scores 9.0–10.0 are Critical, 7.0–8.9 are High, 4.0–6.9 are Medium, and below 4.0 are Low.

Which devices are affected by CVE-2025-0110?

The list of devices confirmed to be affected by CVE-2025-0110 is shown in the "Affected Devices" section above. Check your firmware version against the vendor security advisory and apply the latest patch.

How do I fix or mitigate CVE-2025-0110?

Apply the latest firmware or software update from the vendor. Check the References section above for official advisories and patch notes. If no patch is available, consider disabling the affected feature or isolating the device from untrusted networks.