CVE-2025-0124 PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface
Authenticated attackers with management interface access can delete specific logs and configuration files, requiring restricted management access for mitigation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0124?
CVE-2025-0124 is a medium-severity path traversal vulnerability in Paloaltonetworks Pan-Os, published on 11 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files.
The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.
Weakness: CWE-73
Which versions are affected by CVE-2025-0124?
It affects 1 product.
Products include Paloaltonetworks Pan-Os.
How do I fix CVE-2025-0124?
No fix has been published for CVE-2025-0124 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-0124 being exploited?
There is no known exploitation of CVE-2025-0124 in the wild and no public exploit code.
Other vulnerabilities in Paloaltonetworks Pan-Os
- CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection
- CVE-2020-2021 Palo Alto Networks PAN-OS Authentication Bypass
- CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code Execution
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write
- CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass
Sources
Also known as GHSA-56hj-453m-vxfv.