Description
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW | — | All |
| Palo Alto Networks | Expedition | 1 – < 1.2.100 | 1.2.100 |
| Palo Alto Networks | Panorama | — | All |
| Palo Alto Networks | PAN-OS | — | All |
| Palo Alto Networks | Prisma Access | — | All |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Palo Alto Networks Expedition - OS Command Injection http/cves/2025/CVE-2025-0107.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2025-0037 PaloAlto Networks Expedition: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2025
References
- https://security.paloaltonetworks.com/PAN-SA-2025-0001 vendor-advisory