PT-2024-5656 · Palo Alto Networks · Palo Alto Networks Expedition

Brian Hysell + 1 · Published 2024-06-12 · Updated 2025-11-04 · CVE-2024-5910

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition versions prior to 1.2.92

Description The vulnerability is related to a missing authentication mechanism for a critical function in Palo Alto Networks Expedition, allowing an attacker with network access to take over an admin account and potentially access configuration secrets, credentials, and other data. This issue has been actively exploited by attackers, and it is recommended to update to the latest version to mitigate the risks.

Recommendations Update to Palo Alto Networks Expedition version 1.2.92 or later to fix the missing authentication vulnerability. As a temporary workaround, consider restricting access to the Expedition server to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-06369

CVE-2024-5910

Affected Products

Palo Alto Networks Expedition

References · 133

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/paloalto_expedition_rce.rb · Exploit
• 🔥 https://github.com/zetraxz/CVE-2024-5910 · Exploit
• 🔥 https://horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise · Exploit
• 🔥 https://exploit-db.com/exploits/52129 · Exploit
• https://osv.dev/vulnerability/CVE-2024-5910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06369 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-07-22.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-5910 · Security Note
• https://twitter.com/Raj_Samani/status/1859159116406563065 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1854566888954872028 · Twitter Post
• https://twitter.com/CVEnew/status/1811322711169540185 · Twitter Post
• https://twitter.com/SecurIncCA/status/1854630691239346554 · Twitter Post
• https://twitter.com/inthewildio/status/1854860937980776644 · Twitter Post
• https://twitter.com/EduardKovacs/status/1854837767437455435 · Twitter Post
• https://infosecurity-magazine.com/news/palo-alto-confirms-new-0day · Note