CVE-2024-9464
An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
- Affected products
- Palo Alto Networks Expedition
- Paloaltonetworks Expedition
- < 1.2.96
- CVSS 4.0
- 9.3 CRITICAL
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 82.6% (100th percentile)
- Weakness
- CWE-78
- NVD status
- Modified
- Published
- 2024-10-09
- Attack patterns
- CAPEC-88
Fix
The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions. All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating.
Workaround
Ensure networks access to Expedition is restricted to authorized users, hosts, or networks.
6 known exploits for CVE-2024-9464
Proof-of-concept code and exploit modules indexed by Sploitus