Cyberthreat Advisories | 1898 & Co.

Critical Vulnerabilities in Palo Alto Networks Virtual NGFW

Written by The 1898 & Co. Team | April 10, 2025

Recent security advisories have highlighted multiple critical vulnerabilities affecting Palo Alto Networks Virtual Next-Generation Firewall (NGFW) products. These vulnerabilities, identified by several CVE entries, pose significant risks due to their high CVSS scores, with some reaching a maximum of 10.0. The vulnerabilities impact various configurations, including those with GlobalProtect gateways and DNS Security logging enabled. The potential for exploitation is high, given the nature of the vulnerabilities, which include missing authentication for critical functions and improper neutralization of special elements used in OS commands.

The vulnerabilities affect all versions of Palo Alto Networks Virtual NGFW, necessitating urgent attention from organizations using these products. Exploits could lead to unauthorized access, data breaches, and operational disruptions. The advisories recommend upgrading to version 11.1.8 to mitigate these risks. Additionally, Siemens has provided general security recommendations to protect network access and ensure devices operate within a secure IT environment.

These developments underscore the importance of maintaining up-to-date security measures and monitoring for new patches and updates. Organizations are encouraged to review their current security posture and implement the recommended upgrades and configurations to safeguard against potential threats.



Threats and Vulnerabilities



The identified vulnerabilities in Palo Alto Networks Virtual NGFW include CVE-2024-2550, which affects configurations with GlobalProtect gateways. This vulnerability has a CVSS v3.1 score of 10.0, indicating a critical risk level due to missing authentication for critical functions. Exploitation could allow attackers to gain unauthorized access to sensitive systems.

Another significant threat is CVE-2024-3393, impacting systems with DNS Security logging enabled. This vulnerability also poses a high risk, with a CVSS v4.0 score of 9.3, due to improper neutralization of special elements in OS commands. It could lead to command injection attacks, compromising system integrity.

Additional vulnerabilities include CVE-2025-0108 through CVE-2025-0116, affecting various configurations such as those with LLDP enabled. These vulnerabilities range in severity but collectively represent a substantial threat landscape that requires immediate remediation efforts.



Client Impact



Clients utilizing Palo Alto Networks Virtual NGFW are at risk of significant operational disruptions if these vulnerabilities are exploited. Potential impacts include unauthorized access to critical systems, data breaches resulting in loss or theft of sensitive information, and financial losses due to downtime or regulatory penalties. The reputational damage from such incidents could also be severe, affecting client trust and business continuity.

From a compliance perspective, failure to address these vulnerabilities could lead to non-compliance with industry regulations and standards, resulting in audits or penalties. Organizations must ensure they are aligned with relevant cybersecurity frameworks and guidelines to mitigate these risks effectively.

 

Mitigations

 

To mitigate the identified risks, clients should take the following actions:

  1.  Upgrade all affected Palo Alto Networks Virtual NGFW systems to version 11.1.8 to address the critical vulnerabilities.
  2.  Review and implement the specific remediation steps provided in Palo Alto Networks' security advisories.
  3.  Regularly monitor for new patches and updates from Palo Alto Networks and apply them promptly.
  4.  Configure network environments according to Siemens' operational guidelines for industrial security.
  5.  Subscribe to Palo Alto Networks' RSS feed for timely security alerts and updates.

Implementing these measures will significantly reduce the risk of exploitation and enhance overall security posture. Organizations should also consider conducting regular security assessments and penetration testing to identify potential weaknesses and ensure robust defenses against emerging threats.


1898 & Co Response



1898 & Co is actively addressing the current threat landscape by offering tailored cybersecurity services designed to mitigate risks associated with these vulnerabilities. Our team provides comprehensive assessments and upgrade support for clients using Palo Alto Networks Virtual NGFW products, ensuring they are protected against known threats.

We are enhancing our security protocols by integrating the latest threat intelligence and collaborating with industry experts to stay ahead of emerging threats. Our ongoing research efforts focus on identifying new vulnerabilities and developing effective mitigation strategies.

Clients can benefit from our expertise through customized security solutions that align with their specific needs and industry requirements. We are committed to providing proactive support and guidance to help organizations navigate the complex cybersecurity landscape effectively.

Sources



1. Palo Alto Networks Security Advisories
 
2. Siemens Industrial Security Guidelines
  


Disclaimer