Palo Alto Networks Expedition: OS Command Injection Exposes Credentials
CVE-2025-0107 Published on January 11, 2025

Expedition: OS Command Injection Vulnerability
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Vendor Advisory NVD

Timeline

Initial publication

Corrected the CVSS score to note that authentication is not needed 7 days later.

Weakness Type

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2025-0107 has been classified to as a Shell injection vulnerability or weakness.


Products Associated with CVE-2025-0107

Want to know whenever a new CVE is published for Palo Alto Networks Expedition? stack.watch will email you.

Palo Alto Networks Expedition
 

Affected Versions

Palo Alto Networks Cloud NGFW: Palo Alto Networks Expedition: Palo Alto Networks Panorama: Palo Alto Networks PAN-OS: Palo Alto Networks Prisma Access:

Exploit Probability

EPSS
79.83%
Percentile
99.08%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.