Major Vulnerabilities Patched in SonicWall, Palo Alto Expedition, and Aviatrix Controllers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-50603 | Unauthenticated OS Command Injection (RCE) in Aviatrix Controller CVE-2024-50603 is an unauthenticated OS command injection flaw (CWE-78) in Aviatrix Controllers, rated critical (CVSS 3.1: 9.8), that allows arbitrary code execution. It is triggered by sending shell metacharacters to the controller's /v1/api endpoint - in the cloud_type parameter for the list_flightpath_destination_instances action or the src_cloud_type parameter for the flightpath_connection_test action - where the input is not properly neutralized before being used in an OS command. An attacker who can reach the controller's API gains the ability to run arbitrary commands on the controller, and in observed attacks this has been used to install backdoors and cryptocurrency miners. Organizations running Aviatrix Controller versions before 7.1.4191, or 7.2.x versions before 7.2.4996, are affected. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-16 and carries a 98.5% EPSS probability of exploitation within 30 days. Do: Upgrade to Aviatrix Controller 7.1.4191 or later on the 7.1 branch, or 7.2.4996 or later on the 7.2 branch, per the vendor's instructions; if patching is not immediately possible, restrict network access to the controller's /v1/api endpoint or discontinue use as required by CISA's KEV action. Given active exploitation deploying backdoors and crypto miners, check controllers for signs of compromise (unexpected processes, persistence mechanisms, unusual outbound traffic) and rotate credentials accessible from the controller. | 9.8 | 99% | KEV PoC |
| moderatelikely thousands of controller deployments (estimate; enterprise-only install base, with low thousands of controllers observed internet-exposed in public scans) | |
| CVE-2024-53704 | Authentication Bypass in SonicWall SonicOS SSLVPN CVE-2024-53704 is a critical (CVSS 9.8) improper authentication flaw (CWE-287) in the SSLVPN authentication mechanism of SonicWall's SonicOS. A remote, unauthenticated attacker can exploit it over the network without user interaction, bypassing SSLVPN authentication to gain unauthorized access to the VPN and a foothold into protected internal networks. CISA notes known ransomware use, making this a high-value entry point for follow-on attacks. Any organization running SonicWall SonicOS with SSLVPN enabled is affected. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-02-18, public scans show 5,000+ internet-exposed SonicWall firewalls still unpatched, and EPSS rates the 30-day exploitation probability at 95.1%. Do: Upgrade affected SonicOS deployments to the patched releases listed in SonicWall's advisory, prioritizing internet-facing SSLVPN endpoints. Until patched, restrict or disable SSLVPN exposure where feasible and hunt for signs of exploitation, since ransomware use is known. Remediation must satisfy CISA KEV required actions (apply vendor mitigations or discontinue use). | 9.8 | 95% | KEV ransomware |
| largeestimated tens of thousands of SSLVPN-enabled SonicWall firewall deployments, with at least ~5,000 confirmed still exposed and unpatched on the public internet | |
| CVE-2024-53706 | A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potentia A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potentially lead to code execution. NVD description · AI analysis pending | 7.8 | <1% | — | — | ||
| CVE-2025-0103 | An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashe An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system. NVD description · AI analysis pending | 9.2 group max | <1% |
| — |
Full article658 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 09, 2025Vulnerability / Endpoint Security
Palo Alto Networks has released software patches to address several security flaws in its Expedition migration tool, including a high-severity bug that an authenticated attacker could exploit to access sensitive data.
"Multiple vulnerabilities in the Palo Alto Networks Expedition migration tool enable an attacker to read Expedition database contents and arbitrary files, as well as create and delete arbitrary files on the Expedition system," the company said in an advisory.
"These files include information such as usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software."
Expedition, a free tool offered by Palo Alto Networks to facilitate migration from other firewall vendors to its own platform, reached end-of-life (EoL) as of December 31, 2024. The list of flaws is as follows -
- CVE-2025-0103 (CVSS score: 7.8) - An SQL injection vulnerability that enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys, as well as create and read arbitrary files
- CVE-2025-0104 (CVSS score: 4.7) - A reflected cross-site scripting (XSS) vulnerability that enables attackers to execute malicious JavaScript code in the context of an authenticated user's browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to browser-session theft
- CVE-2025-0105 (CVSS score: 2.7) - An arbitrary file deletion vulnerability that enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host file system
- CVE-2025-0106 (CVSS score: 2.7) - A wildcard expansion vulnerability that allows an unauthenticated attacker to enumerate files on the host file system
- CVE-2025-0107 (CVSS score: 4.4) - An operating system (OS) command injection vulnerability that enables an authenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software
Palo Alto Networks said the vulnerabilities have been addressed in version 1.2.100 (CVE-2025-0103, CVE-2025-0104, and CVE-2025-0107) and 1.2.101 (CVE-2025-0105 and CVE-2025-0106), and that it does not intend to release any additional updates or security fixes.
As workarounds, it's recommended to ensure that all network access to Expedition is restricted to only authorized users, hosts, and networks, or shut down the service if it's not in use.
SonicWall Releases SonicOS Patches
The development coincides with SonicWall shipping patches to remediate multiple flaws in SonicOS, two of which could be abused to achieve authentication bypass and privilege escalation, respectively -
- CVE-2024-53704 (CVSS score: 8.2) - An Improper Authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.
- CVE-2024-53706 (CVSS score: 7.8) - A vulnerability in the Gen7 SonicOS Cloud platform NSv (AWS and Azure editions only) that allows a remote authenticated local low-privileged attacker to elevate privileges to root and potentially lead to code execution.
While there is no evidence that any of the aforementioned vulnerabilities have been exploited in the wild, it's essential that users take steps to apply the latest fixes as soon as possible.
Critical Flaw in Aviatrix Controller Detailed
The updates also come as Polish cybersecurity company Securing detailed a maximum severity security flaw impacting Aviatrix Controller (CVE-2024-50603, CVSS score: 10.0) that could be exploited to obtain arbitrary code execution. It affects versions 7.x through 7.2.4820.
The flaw, which is rooted in the fact that certain code segments in an API endpoint do not sanitize user-supplied parameters ("list_flightpath_destination_instances" and "flightpath_connection_test"), has been addressed in versions 7.1.4191 or 7.2.4996.
"Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to remotely execute arbitrary code," security researcher Jakub Korepta said.
(The story was updated after publication on January 15, 2025, to reflect the change in the CVSS score for CVE-2025-0107 from 2.3 to 4.4.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/major-vulnerabilities-patched-in.html