CVE-2024-9464

CVE-2024-9464 is an OS command injection flaw (CWE-78) in Palo Alto Networks Expedition, the vendor's firewall migration and management tool, that lets an authenticated attacker inject and run arbitrary operating system commands with root privileges on the Expedition host. It is triggered over the network (AV:N) with only low privileges required, meaning any valid, authenticated Expedition session with crafted input, and it requires no user interaction or special conditions. Successful exploitation exposes the sensitive data Expedition stores during migrations, including usernames, cleartext passwords, device configurations, and API keys of managed PAN-OS firewalls. Any organization running Expedition is affected, typically those using the tool to migrate firewalls from other vendors to PAN-OS or to consolidate Panorama deployments. Palo Alto Networks and CISA have warned of active exploitation of Expedition vulnerabilities from this disclosure (CVE-2024-5910, CVE-2024-9463, CVE-2024-9465), related reporting indicates CISA has added the Expedition bugs to its Known Exploited Vulnerabilities catalog, and a very high EPSS score (82.6%, 100th percentile) indicates this flaw is highly likely to be exploited within 30 days.

What to do: Update Expedition to the latest software/content release available from Palo Alto Networks per its advisory (no fixed version is specified in the source data), and restrict the Expedition web interface to trusted management networks or VPN-only access. Because Expedition stores PAN-OS firewall credentials, configurations, and API keys — potentially in cleartext — rotate those credentials and API keys and review Expedition logs for unexpected authenticated activity.