Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-11-28. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚡ CVE-2024-5910 + CVE-2024-9463: Chaining an unauthenticated admin reset with command injection delivers root RCE in Palo Alto Expedition. Read Blog: https://sh3llc0d3.com/blog/palo-alto-networks-expedition-migration-tool-zero-day-chain-from-unauthenticated-admin-reset-to-root-os-command-injection/ #sh3llc0d3 #shellcode #Hacktober #ZeroDay
CISA later added multiple Expedition vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2024-5910, CVE-2024-9463 and CVE-2024-9465. https://t.co/Zn3wjOeHPU
Post summary
The tweet lists CVE-2024-5910, CVE-2024-9463, and CVE-2024-9465 as vulnerabilities that CISA has identified as actively exploited in the wild.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | paloaltonetworks | expedition | - | - | - |