CVE-2025-0109 Overview
CVE-2025-0109 is an unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface. An attacker with network access to the management interface can delete certain files as the nobody user without providing credentials. The scope of deletion includes limited logs and configuration files but excludes system files. The issue is classified under [CWE-73] (External Control of File Name or Path) and does not affect Cloud NGFW or Prisma Access software.
Critical Impact
Unauthenticated attackers with network reachability to the PAN-OS management web interface can delete log and configuration files, disrupting integrity of firewall administration and potentially aiding evasion of forensic review.
Affected Products
- Palo Alto Networks PAN-OS management web interface
- On-premises PAN-OS firewall deployments exposing management access
- Not affected: Cloud NGFW and Prisma Access
Discovery Timeline
- 2025-02-12 - CVE-2025-0109 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0109
Vulnerability Analysis
The vulnerability resides in the PAN-OS management web interface and permits file deletion operations without authentication. Requests reaching the interface can trigger deletion of certain files owned or writable by the nobody user, the low-privilege service account backing the web front-end. Impact is bounded to non-system content, including limited logs and configuration files. The EPSS probability for exploitation is 0.608% at the 45.5 percentile, and Palo Alto Networks has not reported active exploitation.
Deletion of logs undermines auditability of firewall administrative activity. Removal of configuration artifacts can disrupt policy state or force operators to reload backups. Because the vulnerability requires only network reachability and no user interaction, any exposure of the management interface to untrusted networks materially increases risk.
Root Cause
The root cause maps to [CWE-73], External Control of File Name or Path. The management web interface accepts attacker-influenced file path input on an endpoint that lacks authentication enforcement and adequate path validation. As a result, unauthenticated callers reach a file deletion code path executed as nobody.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker with TCP reachability to the PAN-OS management web interface issues crafted HTTP requests that invoke the vulnerable deletion routine. Exposure is significantly higher when the management interface is reachable from the internet or untrusted internal segments.
No public proof-of-concept code is referenced in the advisory. Refer to the Palo Alto Networks CVE-2025-0109 Advisory for vendor technical detail.
Detection Methods for CVE-2025-0109
Indicators of Compromise
- Unexpected gaps or truncation in PAN-OS system, configuration, or traffic logs correlating with unauthenticated HTTP requests to the management interface.
- Missing configuration backup files or audit records that were previously present on the device.
- HTTP requests to management interface endpoints from source addresses outside the approved administrative network.
Detection Strategies
- Correlate web server access logs on the management plane with subsequent file absence or log discontinuities.
- Alert on any inbound connections to the PAN-OS management interface originating from non-administrative IP ranges.
- Baseline expected file inventories on the management plane and flag unexplained deletions.
Monitoring Recommendations
- Forward PAN-OS management and system logs to an external SIEM or data lake so on-device deletions do not eliminate the audit trail.
- Monitor for authentication failures followed by anomalous unauthenticated requests to the same management endpoints.
- Track configuration change history through out-of-band configuration management to detect silent removals.
How to Mitigate CVE-2025-0109
Immediate Actions Required
- Restrict access to the PAN-OS management web interface to trusted internal IP addresses only, per Palo Alto Networks best-practice deployment guidelines.
- Remove any exposure of the management interface to the public internet and audit firewall rules protecting the management plane.
- Apply the vendor-supplied fixed PAN-OS release referenced in the Palo Alto Networks security advisory.
Patch Information
Palo Alto Networks has issued a security advisory tracking this issue. Administrators should consult the Palo Alto Networks CVE-2025-0109 Advisory for fixed PAN-OS versions and upgrade guidance. Cloud NGFW and Prisma Access are not affected and require no action.
Workarounds
- Enforce management access through a dedicated out-of-band management network or jump host.
- Bind the management interface to a non-default data plane and apply ACLs restricting source addresses to administrative subnets.
- Place the management interface behind a VPN or zero-trust access gateway that requires authentication before reaching PAN-OS.
# Example: restrict PAN-OS management access to trusted admin subnet
set deviceconfig system permitted-ip 10.10.0.0/24
commit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
