Critical severity · published Dec 12, 2018
CVE-2018-10143
The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting…
9.8
CVSS
24.8%
EPSS
No
On KEV
Description
The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting this service/application.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)24.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Expedition · Palo Alto Networks
1.0.107 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10143
Third Party Advisory
http://www.securityfocus.com/bid/106174
Exploit
https://doddsecurity.com/234/command-injection-on-palo-alto-networks-expedition/
security.paloaltonetworks.com
https://security.paloaltonetworks.com/CVE-2018-10143
More from Expedition
9.8
CVE-2024-5910
Expedition: Missing Authentication Leads to Admin Account Takeover
9.1
CVE-2024-9465
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
7.5
CVE-2024-9463
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
9.8
CVE-2025-0107
Expedition: OS Command Injection Vulnerability
9.1
CVE-2025-0105
Expedition: Arbitrary File Deletion Vulnerability