Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2025-0107

Expedition: OS Command Injection Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks Cloud NGFW

Default version status: unaffected

  • Allunaffected

Palo Alto Networks Expedition

Default version status: unaffected

  • 1 to < 1.2.100affected

Palo Alto Networks Panorama

Default version status: unaffected

  • Allunaffected

Palo Alto Networks PAN-OS

Default version status: unaffected

  • Allunaffected

Palo Alto Networks Prisma Access

Default version status: unaffected

  • Allunaffected

References