Description
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.
Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Palo Alto Networks | Expedition | 1.2 – < 1.2.92 | 1.2.92 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)
exploit/linux/http/paloalto_expedition_rce
Exploit-DB 1
- Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover EDB-52129 · webapps · Apr 6, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Palo Alto Expedition - Admin Account Takeover http/cves/2024/CVE-2024-5910.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2024-3371 PaloAlto Networks Expedition: Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Nov 7, 2024
References
- https://security.paloaltonetworks.com/CVE-2024-5910 vendor-advisory