CVE-2024-9463: Palo Alto Networks Expedition OS Command Injection Vulnerability
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Other sources
Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks Expeditionto a version that resolves this vulnerability.Fixed in 1.2.96 - Compensating control
If mitigations are unavailable, discontinue use of Palo Alto Networks Expedition.
- Operational
Rotate all Expedition usernames, passwords, and API keys after upgrading to Expedition 1.2.96.
- Operational
Rotate all firewall usernames, passwords, and API keys processed by Expedition after updating Expedition to 1.2.96.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9463?
CVE-2024-9463 has been categorized as a critical vulnerability due to its potential exploitation allowing arbitrary OS command execution.
How do I fix CVE-2024-9463?
To mitigate CVE-2024-9463, upgrade Palo Alto Networks Expedition to a version later than 1.2.96.
What type of vulnerability is CVE-2024-9463?
CVE-2024-9463 is an OS command injection vulnerability that allows unauthorized command execution on the affected system.
What could an attacker gain from exploiting CVE-2024-9463?
Exploitation of CVE-2024-9463 could lead to the disclosure of sensitive information such as usernames, passwords, device configurations, and API keys.
Is authentication required to exploit CVE-2024-9463?
No, an unauthenticated attacker can exploit CVE-2024-9463 to execute arbitrary commands on the affected system.