Critical severity · published Oct 9, 2024
CVE-2024-9465
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
In wildKEV
9.1
CVSS
99.6%
EPSS
Yes
On KEV
Description
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.6% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 14, 2024
Federal remediation dueDec 5, 2024
Ransomware campaign useNot known
Affected products
Which versions
EX
Expedition · Palo Alto Networks
1.2.0 before 1.2.96 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9465
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://security.paloaltonetworks.com/PAN-SA-2024-0010
exploit
https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/
More from Expedition
9.8
CVE-2024-5910
Expedition: Missing Authentication Leads to Admin Account Takeover
7.5
CVE-2024-9463
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
9.8
CVE-2025-0107
Expedition: OS Command Injection Vulnerability
9.8
CVE-2018-10143
The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting…
9.1
CVE-2025-0105
Expedition: Arbitrary File Deletion Vulnerability