Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure
Palo Alto Networks · Expedition
The flaw is an OS command injection vulnerability in Palo Alto Networks Expedition, the product's own component that handles command execution for its operating system. An attacker who already holds valid credentials for Expedition can run arbitrary OS commands as root, which lets them disclose usernames, cleartext passwords, device configurations, and device API keys for PAN-OS firewalls; the attack is reachable over the network, requires only low-privilege authentication, and needs no user interaction.
An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available the same day.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.