CVE-2025-0110: Palo Alto Networks PAN-OS RCE Vulnerability

CVE-2025-0110 Overview

A command injection vulnerability has been identified in the Palo Alto Networks PAN-OS OpenConfig plugin that enables an authenticated administrator with the ability to make gNMI (gRPC Network Management Interface) requests to the PAN-OS management web interface to bypass system restrictions and execute arbitrary commands. The injected commands are executed with the privileges of the __openconfig user, which operates with the Device Administrator role on the firewall.

This vulnerability poses a significant risk to organizations using the OpenConfig plugin, as it allows authenticated attackers to break out of intended administrative boundaries and gain broader system access. The attack requires network access to the management interface and valid administrator credentials.

Critical Impact

Authenticated administrators can bypass system restrictions and execute arbitrary commands with Device Administrator privileges on Palo Alto Networks firewalls, potentially leading to complete device compromise.

Affected Products

• Palo Alto Networks PAN-OS with OpenConfig plugin enabled
• Systems with gNMI request capabilities exposed to the management web interface
• Firewalls where management web interface is accessible from untrusted networks

Discovery Timeline

• 2025-02-12 - CVE-2025-0110 published to NVD
• 2025-02-12 - Last updated in NVD database

Technical Details for CVE-2025-0110

Vulnerability Analysis

This command injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) exists within the OpenConfig plugin component of PAN-OS. The vulnerability allows authenticated administrators who can make gNMI requests to inject and execute arbitrary operating system commands on the underlying firewall system.

The exploitation occurs through the gNMI interface, which is used for network device configuration and state management using a standardized data model. When crafted requests are sent through this interface, the OpenConfig plugin fails to properly sanitize input, allowing command injection payloads to be executed.

Commands executed through this vulnerability run in the context of the __openconfig user account, which has been assigned the Device Administrator role. This level of access provides significant control over the firewall's configuration and operation.

Root Cause

The root cause of CVE-2025-0110 is improper input validation within the OpenConfig plugin when processing gNMI requests. The plugin fails to adequately sanitize user-supplied input before passing it to system command execution functions, allowing specially crafted input containing shell metacharacters or command sequences to be interpreted and executed by the underlying operating system.

Attack Vector

The attack is conducted over the network, targeting the PAN-OS management web interface. An attacker must first authenticate as an administrator with permissions to make gNMI requests. Once authenticated, the attacker can craft malicious gNMI requests containing command injection payloads that bypass the expected input handling.

The exploitation flow involves:

1. Authenticating to the PAN-OS management interface with valid administrator credentials
2. Establishing a gNMI session with the OpenConfig plugin
3. Sending specially crafted requests containing command injection payloads
4. The commands execute with __openconfig user privileges (Device Administrator role)

Due to the authenticated nature of this attack, the primary risk involves insider threats or scenarios where administrator credentials have been compromised. The vulnerability becomes significantly more dangerous when the management interface is accessible from untrusted networks.

Detection Methods for CVE-2025-0110

Indicators of Compromise

• Unusual gNMI request patterns or high volume of requests to the OpenConfig plugin
• Unexpected process executions originating from the __openconfig user context
• Anomalous command-line arguments or shell spawning from OpenConfig-related processes
• Suspicious administrative authentication events followed by gNMI activity

Detection Strategies

• Monitor and log all gNMI requests to the PAN-OS management interface for suspicious patterns
• Implement behavioral analysis to detect unusual command execution patterns from the __openconfig user
• Review authentication logs for administrator accounts with gNMI access privileges
• Deploy network monitoring to detect anomalous traffic to management interfaces

Monitoring Recommendations

• Enable comprehensive logging on the PAN-OS management interface
• Implement SIEM rules to correlate authentication events with subsequent gNMI request anomalies
• Establish baselines for normal gNMI activity and alert on deviations
• Monitor for any file system changes or network connections initiated by the __openconfig user

How to Mitigate CVE-2025-0110

Immediate Actions Required

• Restrict access to the management web interface to only trusted internal IP addresses following Palo Alto Networks best practices deployment guidelines
• Review and limit administrator accounts that have the ability to make gNMI requests
• Implement network segmentation to isolate management interfaces from general network access
• Monitor for any suspicious activity targeting the OpenConfig plugin

Patch Information

Palo Alto Networks has released a security advisory addressing this vulnerability. Organizations should consult the official Palo Alto Networks security advisory for CVE-2025-0110 for specific patch versions and upgrade instructions. Apply the recommended updates to affected PAN-OS installations as soon as possible.

Workarounds

• Disable the OpenConfig plugin if it is not required for operations
• Implement strict IP-based access controls for the management web interface
• Use VPN or jump hosts to access management interfaces rather than direct network exposure
• Review and minimize the number of administrator accounts with gNMI capabilities

# Configuration example: Restrict management interface access to trusted IPs
# Consult Palo Alto Networks documentation for specific CLI commands
# Example approach: Configure permitted-ip settings on management profile
# set deviceconfig system permitted-ip <trusted-ip-address>