CVE-2024-9463

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

Affected

Palo Alto Networks · Expedition

CVSS v4.0 PALOALTONETWORKS

9.9 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

98.55% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2024-11-14

Nuclei

critical · CWE-78

Published

2024-10-09

Updated

2025-10-21

Proof-of-concept exploits (1)

• momo1239/CVE-2024-9463-Proof-of-Concept1★ · 2025-05-22

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9463.yaml

Exploit collections (1)

• CVE-2024-9463.yamlzan8in/afrog

Security advisories

• https://security.paloaltonetworks.com/PAN-SA-2024-0010

References

• CVE Record
• NVD entry

Related

• CVE-2023-24203
• CVE-2023-24204
• CVE-2024-35333