Cyber Threat

Critical Alert: Hackers Actively Exploiting Palo Alto and SonicWall Security Flaws, CISA Warns

ClickControl

Author

February 24, 2025

Published

Reading

Critical Alert: Hackers Actively Exploiting Palo Alto and SonicWall Security Flaws, CISA Warns

Critical Security Vulnerabilities Found in Palo Alto Networks and SonicWall Systems

CISA has identified and added two significant security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, affecting Palo Alto Networks PAN-OS and SonicWall SonicOS SSLVPN systems.

Key Vulnerabilities:

1. Palo Alto Networks PAN-OS (CVE-2025-0108)
– Severity Score: 7.8
– Type: Authentication bypass vulnerability
– Impact: Allows unauthenticated attackers to bypass security and execute PHP scripts
– Current Status: Active exploitation confirmed

2. SonicWall SonicOS SSLVPN (CVE-2024-53704)
– Severity Score: 8.2
– Type: Improper authentication vulnerability
– Impact: Enables remote authentication bypass

Threat Analysis:
– GreyNoise reports 25 malicious IP addresses actively exploiting CVE-2025-0108
– Attack traffic primarily originates from the US, Germany, and Netherlands
– Exploitation attempts have increased tenfold in the past week
– Potential for vulnerability chaining with CVE-2024-9474 and CVE-2025-0111

Required Action:
Federal Civilian Executive Branch agencies must implement patches by March 11, 2025. CISA has subsequently added CVE-2025-0111 to the KEV catalog, with a compliance deadline of March 13, 2025.

Keywords: network security vulnerabilities, Palo Alto PAN-OS exploit, SonicWall SSLVPN vulnerability, CISA security advisory, authentication bypass vulnerability, cybersecurity threats

Share This Article