CVE-2024-5910criticalunder attackCWE-306

CVE-2024-5910: critical vulnerability in Palo Alto Networks Expedition

Expedition: Missing Authentication Leads to Admin Account Takeover

Published · Updated

Follow this CVE+ Monitor Expedition

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.3epss 92%
from disclosure to weapon128 days
Published on NVDJul 10
1st PoC+128d
metasploit+91d
CISA KEV+120d
Action required by CISAfederal deadline: 2024-11-28

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Expedition, a Palo Alto Networks configuration migration tool, is missing authentication checks on a critical function, allowing attackers with network access to take over admin accounts and steal sensitive configuration data and credentials.

Technical detail

CWE-306 (Missing Authentication) in Expedition allows unauthenticated attackers with network access to bypass critical function authentication, leading to complete compromise of admin accounts and exposure of imported configuration secrets and credentials. Exploitation requires only network connectivity to the Expedition instance.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:D/RE:M/U:Red
Affected products
Palo Alto Networks · Expedition
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Palo Alto Networks Expedition

In the same product, most dangerous first.

CVE-2024-9465CRITICALExpedition: SQL Injection Leads to Firewall Admin Credential DisclosureEPSS 99.6%KEVCVE-2024-9463CRITICALExpedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential DisclosureEPSS 98.5%KEVCVE-2024-9464CRITICALExpedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential DisclosureEPSS 82.6%CVE-2025-0107HIGHExpedition: OS Command Injection VulnerabilityEPSS 78.4%CVE-2024-9466HIGHExpedition: Cleartext Storage of Information Leads to Firewall Admin Credential DisclosureEPSS 13.6%CVE-2025-0105MEDIUMExpedition: Arbitrary File Deletion VulnerabilityEPSS 13.2%