Actively exploited in the wild
Palo Alto Networks Expedition OS Command Injection Vulnerability
Palo Alto Networks - Expedition · Listed in the CISA KEV since 2024-11-14. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-9463
HighCVSS 7.5KEVSummary
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Risk Assessment
An unauthenticated attacker can gain full root control of the Expedition system and steal credentials and API keys for PAN-OS firewalls, potentially leading to compromise of the entire network infrastructure.
Recommendation
Update Palo Alto Networks Expedition to a fixed version as soon as possible, restrict network access to Expedition, and immediately revoke and rotate any potentially exposed credentials and API keys.
Other vulnerabilities in Palo Alto Networks Expedition
See all- CVE-2024-9465CriticalActively exploited
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal database contents, such as password hashes, usernames, device configurations, and API keys. Attackers can also create and read arbitrary files on the system.
- CVE-2024-5910CriticalActively exploited
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access. Configuration secrets, credentials, and other data imported into Expedition are at risk.
Original NVD description (English source)
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.