CVE-2025-0107

Expedition: OS Command Injection Vulnerability

State: Published
Severity: 7.7 High
Published: Jan 11, 2025
Updated: Jan 24, 2025
Reserved: Dec 20, 2024

Description

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Green	palo_alto

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Cloud NGFWPalo Alto Networks	AllNot affected
ExpeditionPalo Alto Networks	1 to before 1.2.100Affectedfrom 1.2.100Not affected
PanoramaPalo Alto Networks	AllNot affected
PAN-OSPalo Alto Networks	AllNot affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/PAN-SA-2025-0001vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.