CVE-2025-0107

CVE-2025-0107 is an unauthenticated OS command injection flaw (CWE-78) in Palo Alto Networks Expedition, the vendor's migration and assessment tool for PAN-OS firewalls. A remote attacker with no credentials or user interaction can send a crafted request to the Expedition web interface and execute arbitrary operating system commands as the www-data user. Because Expedition stores migration and management data, the attacker gains access to usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software that Expedition manages. Only organizations running Expedition — typically those performing PAN-OS migrations or bulk assessments — are affected; organizations running only PAN-OS firewalls without Expedition are not directly exposed. As of the current data there is no public proof-of-concept and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog, but EPSS assigns a 78.5% probability of exploitation within 30 days (100th percentile), indicating an elevated near-term risk.

What to do: Update Expedition to the latest patched release per the Palo Alto Networks advisory, and restrict the Expedition web interface to trusted management networks or VPN access. Because the flaw can expose stored PAN-OS credentials, configurations, and API keys, review Expedition logs for unexpected www-data command activity and rotate affected firewall passwords and API keys once patched.