Technical impact
An arbitrary file read and delete flaw in Palo Alto Networks WildFire WF-500 and WF-500-B appliances allows an attacker to read sensitive files and delete arbitrary files. The weakness is classified as CWE‑73 due to improper handling of file paths and could expose confidential data or corrupt system state within the appliance's filesystem.
Affected Systems
The vulnerability affects WildFire WF-500 and WF-500-B appliances running in the default non‑FIPS configuration mode. Firmware versions that require remediation include 12.1.5‑12.1.6 (upgrade to 12.1.7 or later), 12.1.2‑12.1.4‑h* (upgrade to 12.1.4‑h5 or 12.1.7 or later), 11.2.11 or later (upgrade to 11.2.12 or later), 11.2.8‑11.2.10‑h* (upgrade to 11.2.10‑h6 or 11.2.12 or later), 11.2.5‑11.2.7‑h* (upgrade to 11.2.7‑h13 or 11.2.12 or later), 11.2.0‑11.2.4‑h* (upgrade to 11.2.4‑h17 or 11.2.12 or later), 11.1.14 or later (upgrade to 11.1.15 or later), 11.1.11‑11.1.13‑h* (upgrade to 11.1.13‑h5 or 11.1.15 or later), 11.1.8‑11.1.10‑h* (upgrade to 11.1.10‑h25 or 11.1.15 or later), 11.1.7‑11.1.7‑h* (upgrade to 11.1.7‑h6 or 11.1.15 or later), 11.1.5‑11.1.6‑h* (upgrade to 11.1.6‑h32 or 11.1.15 or later), 11.1.0‑11.1.4‑h* (upgrade to 11.1.4‑h33 or 11.1.15 or later), 10.2.17‑10.2.18‑h* (upgrade to 10.2.18‑h6 or later), 10.2.14‑10.2.16‑h* (upgrade to 10.2.16‑h7 or 10.2.18‑h6 or later), 10.2.11‑10.2.13‑h* (upgrade to 10.2.13‑h21 or 10.2.18‑h6 or later), 10.2.8‑10.2.10‑h* (upgrade to 10.2.10‑h36 or 10.2.18‑h6 or later), 10.2.0‑10.2.7‑h* (upgrade to 10.2.7‑h34 or 10.2.18‑h6 or later). Version 10.1 and earlier are End‑of‑Life and no fix is planned.
Risk and Exploitability
The CVSS score is 5, indicating a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user with access to the appliance console or API, as the flaw can only be exercised from within the appliance's configuration mode. An attacker could read confidential files on the device or delete important configuration files, potentially disrupting sandbox operations.
