{"id":"CVE-2025-0107","published":"2025-01-11T03:02:49Z","modified":"2025-01-24T04:56:01Z","title":"Expedition: OS Command Injection Vulnerability","vendor":"Palo Alto Networks","product":"Cloud NGFW","tier":"core","eol":null,"affectedVersions":[{"vendor":"Palo Alto Networks","product":"Expedition","versions":[">= 1, < 1.2.100"]}],"description":{"text":"An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.","provenance":"source","from":"CVE.org"},"summary":{"text":"An OS command injection flaw in Palo Alto Networks Expedition, the component associated with the Cloud NGFW product line, lets crafted input be passed to the operating system without proper neutralization. An unauthenticated attacker with network access to Expedition can run arbitrary OS commands as the www-data user, which exposes usernames, cleartext passwords, device configurations, and device API keys for connected PAN-OS firewalls, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:09Z"},"cvss":{"score":7.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Green","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.78416,"percentile":0.99582,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-06-25","exploitedFirstSeen":"2025-06-25","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-0107","date":"2025-06-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-15&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-16&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-18&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-19&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-21&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-22&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-23&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-24&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-25&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-25"}],"evidenceTotal":163,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://security.paloaltonetworks.com/PAN-SA-2025-0001","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-1504","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1504","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-0107","name":"Palo Alto Networks Expedition - OS Command Injection","severity":"critical","path":"http/cves/2025/CVE-2025-0107.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0107.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-01-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-0107","provenance":"source"},{"date":"2025-06-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-0107","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":65.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 493 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9958"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.39,"detail":"base score 7.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}