--- title: "Security digest: February 18, 2025" url: https://erroneo.us/security/2025-02-18/ description: "February 18, 2025 vulnerability digest: 2 CISA KEV additions (Palo Alto Networks, SonicWall); 2 critical advisories (NuGet). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2025-02-18 date_modified: 2025-02-18 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: February 18, 2025 2 known exploited (cisa kev) additions and 2 critical advisories. ## Take stock - Do you run any of these? Palo Alto Networks PAN-OS, SonicWall SonicOS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-03-11. - NuGet: 2 critical advisories ( CIE.AspNetCore.Authentication , SPID.AspNetCore.Authentication ). Check with dotnet list package --vulnerable --include-transitive . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2025-0108](https://erroneo.us/security/cve/CVE-2025-0108/index.md) Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (CISA due 2025-03-11) - [CVE-2024-53704](https://erroneo.us/security/cve/CVE-2024-53704/index.md) SonicWall SonicOS: SonicWall SonicOS SSLVPN Improper Authentication Vulnerability (CISA due 2025-03-11) ## Critical advisories - [CVE-2025-24895](https://erroneo.us/security/cve/CVE-2025-24895/index.md) AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass — NuGet CIE.AspNetCore.Authentication <= 2.0.4 → 2.1.0 - [CVE-2025-24894](https://erroneo.us/security/cve/CVE-2025-24894/index.md) The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass — NuGet SPID.AspNetCore.Authentication <= 3.3.0 → 3.4.0 --- Source page: https://erroneo.us/security/2025-02-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt