CVE-2024-9466

Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure

A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.

Affected

Palo Alto Networks · Expedition

CVSS v4.0 PALOALTONETWORKS

8.2 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

13.58% chance of exploitation in the next 30 days, 96th percentile

Published

2024-10-09

Updated

2025-09-04

Proof-of-concept exploits (2)

• https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromis…
• holypryx/CVE-2024-94661★ · 2024-10-19

Exploit collections (1)

• CVE-2024-9466.yamlzan8in/afrog

Security advisories

• https://security.paloaltonetworks.com/PAN-SA-2024-0010

References

• CVE Record
• NVD entry

Related

• CVE-2024-10140