CVE-2025-0110

Deeper analysis

A command injection vulnerability tracked as CVE-2025-0110 affects the OpenConfig plugin in Palo Alto Networks PAN-OS. An authenticated administrator who can issue gNMI requests against the PAN-OS management web interface can bypass existing restrictions and execute arbitrary operating-system commands on the firewall; the injected commands run in the context of the built-in “__openconfig” account, which possesses the Device Administrator role.

Exploitation requires an account with administrative privileges and the ability to reach the management interface with gNMI requests. Successful attacks allow the adversary to run any command permitted to the __openconfig user, effectively granting broad control over the affected firewall without needing additional credentials.

The vendor advisory recommends reducing exposure by restricting management-web-interface access to trusted internal IP addresses in accordance with Palo Alto Networks’ published best-practice deployment guidelines. No other specific configuration changes or plugin-level workarounds are described.

EPSS for the issue rose from a low baseline to a peak of 0.0314 on 2025-12-11 before receding, indicating a measurable increase in exploitation interest several months after the February 2025 disclosure.