CVE-2025-0107highexploração observadaCWE-78

CVE-2025-0107: falha de alta gravidade em Palo Alto Networks Expedition

Expedition: OS Command Injection Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar PAN-OS+ Monitorar Prisma Access

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

80Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 7.7epss 78%
da publicação à arma
Publicada no NVD11 de jan.
VulnCheck+165d
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Green
Produtos afetados
Palo Alto Networks · Cloud NGFWPalo Alto Networks · ExpeditionPalo Alto Networks · PanoramaPalo Alto Networks · PAN-OSPalo Alto Networks · Prisma Access
CVEs relacionadas — Palo Alto Networks Expedition

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3400CRITICALPAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectEPSS 100.0%KEVCVE-2024-0012CRITICALPAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)EPSS 99.8%KEVCVE-2024-9465CRITICALExpedition: SQL Injection Leads to Firewall Admin Credential DisclosureEPSS 99.6%KEVCVE-2024-9463CRITICALExpedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential DisclosureEPSS 98.5%KEVCVE-2025-0108HIGHPAN-OS: Authentication Bypass in the Management Web InterfaceEPSS 98.5%KEVCVE-2026-0257HIGHPAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesEPSS 95.6%KEV