CVE-2025-0107 | THREATINT

Description

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Reserved 2024-12-20 | Published 2025-01-11 | Updated 2025-01-24 | Assigner palo_alto

HIGH: 7.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Green

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status

unaffected

All

unaffected

Default status

unaffected

1 before 1.2.100

affected

Default status

unaffected

All

unaffected

Default status

unaffected

All

unaffected

Default status

unaffected

All

unaffected

Timeline

2025-01-08:	Initial publication
2025-01-15:	Corrected the CVSS score to note that authentication is not needed

Credits

An independent security researcher working with SSD Secure Disclosure finder

Advanced Research Team, CrowdStrike finder

References

security.paloaltonetworks.com/PAN-SA-2025-0001 vendor-advisory

cve.org (CVE-2025-0107)

nvd.nist.gov (CVE-2025-0107)

Download JSON