CVE-2024-9463 - Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

Back Back to CVE browser

CRITICAL KEV

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

Published Oct 9, 2024 ·Due Dec 5, 2024

9.9

CRITICAL

CVSS 4.0

EPSS 98.55%

Description

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

Affected products

Vendor Palo Alto Networks Product Expedition Default
unaffected
- Version
  1.2.0
  Status
  affected
  Constraints
  <1.2.96

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Expedition

unaffected

Version	Status	Constraints
1.2.0	affected	<1.2.96

Remediation

Vendor solution

The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions.

All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition.

All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://security.paloaltonetworks.com/PAN-SA-2024-0010
vendor-advisoryMitigationVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463
government-resourceUS Government Resource

Link	Providers	Tags
https://security.paloaltonetworks.com/PAN-SA-2024-0010		vendor-advisoryMitigationVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463		government-resourceUS Government Resource