Palo Alto Networks PAN-OS Authenticated Admin File Read Vulnerability in PAN-OS CLI

A vulnerability exists in Palo Alto Networks PAN-OS software that allows an authenticated admin to read arbitrary files via the PAN-OS command-line interface (CLI). This issue requires network access to the management interface (web, SSH, console, or telnet) and successful authentication. The vulnerability does not affect Cloud NGFW or Prisma Access. To mitigate this issue, it is recommended to restrict management interface access to trusted users and internal IP addresses, following Palo Alto Networks' critical deployment guidelines.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files, potentially allowing for further exploitation or information disclosure.

Remediation

This vulnerability is fixed in PAN-OS versions 10.1.14-h11, 10.2.11, 11.0.6, 11.1.5, 11.2.3, and all later PAN-OS versions. For older, unsupported PAN-OS versions, upgrade to a supported fixed version. Additionally, review and apply the recommended mitigation measures to secure management interface access.