Palo Alto Networks · Expedition
CVE-2024-5910
Expedition: Missing Authentication Leads to Admin Account Takeover
What it is
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.
Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
CISA: Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: November 28, 2024
More exploited flaws from Palo Alto Networks
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 14, 2024 | OS Command Injection | Expedition | Critical 9.9 | 99% |
| Nov 14, 2024 | SQL Injection | Expedition | Critical 9.2 | 99.6% |
| Oct 14, 2026 | Code Injection | PAN-OS | High 8.6 | 1.7% |
| May 29, 2026 | Authentication Bypass | PAN-OS | High 7.8 | 95% |
| May 6, 2026 | Out-of-bounds Write | PAN-OS | Critical 9.3 | 42% |
| Feb 20, 2025 | File Read | PAN-OS | High 7.1 | 2.0% |
| Feb 18, 2025 | Authentication Bypass | PAN-OS | High 8.8 | 98% |
| Dec 30, 2024 | Malicious DNS Packet | PAN-OS | High 8.7 | 29% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.