⚠ Actively exploited
Added to CISA KEV on 2024-11-14. Federal agencies required to patch by 2024-12-05. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable..
CVE-2024-9463 — OS Command Injection in Palo Alto Networks Expedition
Severity
9.9CRITICALNVD
EPSS
94.2%
top 0.08%
CISA KEV
KEV
Added 2024-11-14
Due 2024-12-05
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedOct 9
KEV addedNov 14
Latest updateNov 19
KEV dueDec 5
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
Affected Packages2 packages
🔴Vulnerability Details
3CVEList▶
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure↗2024-10-09
GHSA▶
GHSA-r2fh-mj7f-v33r: An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expe↗2024-10-09
💥Exploits & PoCs
1Nuclei▶
PaloAlto Networks Expedition - Remote Code Execution