Actively exploited · Published Oct 9, 2024 · Assigned by palo_alto
CVE-2024-9463Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
Critical 9.9 Exploited
In plain English
A critical-severity OS command injection in Expedition from Palo Alto Networks. Attackers are actively exploiting it in the wild (listed by CISA on November 14, 2024). The chance it is exploited in the next 30 days is estimated at 98.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 5, 2024.
Official description
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Expedition | 1.2.0 – before 1.2.96 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber
References
- https://security.paloaltonetworks.com/PAN-SA-2024-0010 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463 government-resource