Skip to content
Fencer Vulns
medium 6.5

CVE-2024-9464 json

Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

published 2024-10-09 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-49956

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
82.6%
EPSS 82.6% chance of exploitation in 30 days, percentile 99.6%
public exploits
1
Metasploit

Summary

An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

Patch / fix

  • Palo Alto Networks Expedition 1.2.96
  • paloaltonetworks expedition 1.2.96

Timeline

  1. First public exploit (Metasploit exploit/linux/http/paloalto_expedition_rce)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

82.61% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/linux/http/paloalto_expedition_rce Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464) metasploit exploit, excellent rank, 2024-10-09
  • horizon3.ai https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Palo Alto Networks Expedition
  • paloaltonetworks expedition

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.