CVE-2024-9465criticalunder attackCWE-89

CVE-2024-9465: critical vulnerability in Palo Alto Networks Expedition

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

Published · Updated

Follow this CVE+ Monitor Expedition

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.2epss 100%
from disclosure to weaponsame day
Published on NVDOct 9
1st PoCOct 9
CISA KEV+36d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 24/2024Vulnerabilidades na solução Palo Alto Networks Expeditionread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2024-12-05

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Expedition has a critical SQL injection flaw that lets attackers access the database without logging in, stealing passwords, usernames, device settings, and API keys. Attackers can also create and read files on the affected system.

Technical detail

An unauthenticated SQL injection vulnerability in Palo Alto Networks Expedition enables attackers to execute arbitrary SQL queries against the backend database, exfiltrating sensitive data including password hashes, device configurations, and API credentials. The vulnerability also permits arbitrary file read/write operations on the Expedition system, potentially leading to complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber
Affected products
Palo Alto Networks · Expedition
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Palo Alto Networks Expedition

In the same product, most dangerous first.

CVE-2024-9463CRITICALExpedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential DisclosureEPSS 98.5%KEVCVE-2024-5910CRITICALExpedition: Missing Authentication Leads to Admin Account TakeoverEPSS 91.7%KEVCVE-2024-9464CRITICALExpedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential DisclosureEPSS 82.6%CVE-2025-0107HIGHExpedition: OS Command Injection VulnerabilityEPSS 78.4%CVE-2024-9466HIGHExpedition: Cleartext Storage of Information Leads to Firewall Admin Credential DisclosureEPSS 13.6%CVE-2025-0105MEDIUMExpedition: Arbitrary File Deletion VulnerabilityEPSS 13.2%