Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2025-0107 — OS Command Injection in Palo Alto Networks Expedition
Severity
7.7HIGHNVD
EPSS
79.8%
top 0.90%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJan 11
Latest updateSep 26
Description
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N
Affected Packages2 packages
🔴Vulnerability Details
3GHSA▶
GHSA-mhj4-9938-5fpw: An OS command injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to run arbitrary OS commands as the www-data↗2025-01-11
VulnCheck▶
Palo Alto Networks Expedition Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')↗2025
💥Exploits & PoCs
1Nuclei▶
Palo Alto Networks Expedition - OS Command Injection