← CVE Intelligence

CVE-2025-0107

Expedition: OS Command Injection Vulnerability PUBLISHED

Description (CNA)

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Affected (CNA)

Vendor / productVersions
Palo Alto Networks / Cloud NGFWunaffected All
Palo Alto Networks / Expeditionaffected 1 before 1.2.100
Palo Alto Networks / Panoramaunaffected All
Palo Alto Networks / PAN-OSunaffected All
Palo Alto Networks / Prisma Accessunaffected All

CWE

CWE-78

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.