CVE-2024-9463 — Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

CVE-2024-9463

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure PUBLISHED

Description (CNA)

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

Affected (CNA)

Vendor / product	Versions
Palo Alto Networks / Expedition	affected 1.2.0 before 1.2.96

CWE

CWE-78

References

https://security.paloaltonetworks.com/PAN-SA-2024-0010

ADP enrichment

CISA-ADP

No English description supplied.

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463