CVE-2025-0111:

Authenticated file read vulnerability in the PAN-OS management web interface could allow an authenticated remote attacker with network access to read files on the PAN-OS filesystem that are readable by the nobody user. The risk is greatest if the management interface is exposed to the internet or an untrusted network. This issue does not affect Cloud NGFW or Prisma Access.

This CVE (CVE-2025-0111) is categorized as CWE-73 External Control of File Name or Path and is described as an authenticated file read vulnerability affecting PAN-OS, with exploitation requiring network access to the management web interface. The impact is notable for files read by the nobody user, and the CVSS assessments include a high base score of 7.1 (CVSS v4.0) reflecting remote, unauthenticated exposure under certain conditions, and a secondary metric indicating medium severity with higher privileges required in some contexts. The vulnerability affects multiple PAN-OS lines across versions with a fix in newer builds; the highest risk remains when management access is reachable from external networks. Palo Alto Networks notes that the vulnerability does not impact Cloud NGFW or Prisma Access. Exploit attempts have been observed chaining this vulnerability with other PAN-OS web management interface flaws on unsecured devices.