Login Request a demo
High severity · published Oct 9, 2024
CVE-2024-9463
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
In wildKEV
7.5
CVSS
98.5%
EPSS
Yes
On KEV
Description
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)98.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 14, 2024
Federal remediation dueDec 5, 2024
Ransomware campaign useNot known
Affected products
Which versions
EX
Expedition · Palo Alto Networks
1.2.0 before 1.2.96 · source: vendor, NVD, KEV
Affected product
EX
Expedition
Palo Alto Networks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9463
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9463
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://security.paloaltonetworks.com/PAN-SA-2024-0010
More from Expedition
9.8
CVE-2024-5910
Expedition: Missing Authentication Leads to Admin Account Takeover
9.1
CVE-2024-9465
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
9.8
CVE-2025-0107
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which…
9.8
CVE-2018-10143
The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting…
9.1
CVE-2025-0105
An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host…