{"id":"CVE-2024-9464","published":"2024-10-09T17:03:33Z","modified":"2024-10-18T15:40:20Z","title":"Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure","vendor":"Palo Alto Networks","product":"Expedition","tier":"core","eol":null,"affectedVersions":[{"vendor":"Palo Alto Networks","product":"Expedition","versions":[">= 1.2.0, < 1.2.96"]}],"description":{"text":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an OS command injection vulnerability in Palo Alto Networks Expedition, the product's own component that handles command execution for its operating system. An attacker who already holds valid credentials for Expedition can run arbitrary OS commands as root, which lets them disclose usernames, cleartext passwords, device configurations, and device API keys for PAN-OS firewalls; the attack is reachable over the network, requires only low-privilege authentication, and needs no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:38Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.82612,"percentile":0.99664,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://security.paloaltonetworks.com/PAN-SA-2024-0010","tags":["vendor-advisory"]},{"url":"https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-49956","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49956","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-10-09","earliestUrl":"https://github.com/horizon3ai/CVE-2024-9464","repos":[{"name":"horizon3ai/CVE-2024-9464","url":"https://github.com/horizon3ai/CVE-2024-9464","stars":45,"created":"2024-10-09"}]},"first":{"date":"2024-10-09","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2024-9464"},"provenance":"source"},"exploitRefs":["https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/"],"flow":[],"timeline":[{"date":"2024-10-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-9464","provenance":"source"},{"date":"2024-10-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2024-9464","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9966"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}