reduce exposure to PAN-OS vulnerabilities like CVE-2025-0111

[tofu159mac]

Hello,

What immediate steps should network admins take to reduce exposure to PAN-OS vulnerabilities like CVE-2025-0111 when no official patch is yet available?

[kiwi]

Hi @tofu159mac ,

In a lot of cases following best practices will provide you a lot of protection. 

CVE-2025-0111 is an authenticated file read vulnerability that affects the firewall's management interface. The primary risk is when this interface is accessible from external or untrusted networks.  You greatly reduce the risk if you ensure that you allow only trusted internal IP addresses to access the management interface.

This can be done by configuring a management profile on the management interface or any data plane interface that has management access enabled. The profile should only allow access from specific trusted internal subnets or a dedicated jump host.  Also ensure that you do not have any security policies that allow traffic from the untrust zone to the management IP address. If the management interface is exposed to the internet, your risk is at its highest.

I strongly recommend subscribing to Palo Alto Networks' security advisories for recommendations/updates on CVE's like the one you mentioned:

https://security.paloaltonetworks.com/CVE-2025-0111

Kind regards,

Kim.