High severity · published Oct 9, 2024
CVE-2024-9463
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
In wildKEV
7.5
CVSS
98.5%
EPSS
Yes
On KEV
Description
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)98.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 14, 2024
Federal remediation dueDec 5, 2024
Ransomware campaign useNot known
Affected products
Which versions
EX
Expedition · Palo Alto Networks
1.2.0 before 1.2.96 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9463
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9463
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://security.paloaltonetworks.com/PAN-SA-2024-0010
More from Expedition
9.8
CVE-2024-5910
Expedition: Missing Authentication Leads to Admin Account Takeover
9.1
CVE-2024-9465
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
9.8
CVE-2025-0107
Expedition: OS Command Injection Vulnerability
9.8
CVE-2018-10143
The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting…
9.1
CVE-2025-0105
Expedition: Arbitrary File Deletion Vulnerability