{"id":"CVE-2024-9464","aliases":["EUVD-2024-49956","GHSA-r7wf-fpff-w68q"],"status":"published","title":"Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure","description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.82612,"percentile":0.99671,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2024-10-09T17:03:33Z","modified":"2026-06-17T08:24:37Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/paloalto_expedition_rce","title":"Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)","type":"exploit","platform":"Linux,Unix","date":"2024-10-09","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/paloalto_expedition_rce"},{"source":"pocgithub","id":"horizon3ai/CVE-2024-9464","title":"horizon3ai/CVE-2024-9464","date":"2024-10-09","url":"https://github.com/horizon3ai/CVE-2024-9464"}],"products":[{"vendor":"palo alto networks","product":"expedition"},{"vendor":"paloaltonetworks","product":"expedition"}],"references":[{"url":"https://security.paloaltonetworks.com/PAN-SA-2024-0010","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9464"},{"url":"https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise"},{"url":"https://github.com/advisories/GHSA-r7wf-fpff-w68q"}],"sources":{"cve":[{"id":"CVE-2024-9464","title":"Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure","description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.","status":"published","published":"2024-10-09T17:03:33.904Z","modified":"2024-10-18T15:40:20.097Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:05.823187Z"}],"euvd":[{"id":"EUVD-2024-49956","description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.","status":"published","published":"2024-10-09T17:03:33Z","modified":"2024-10-18T15:40:20Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber","level":"critical"}],"updated_at":"2026-11-03T00:27:32.691525Z"}],"ghsa":[{"id":"GHSA-r7wf-fpff-w68q","title":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated...","description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.","status":"published","published":"2024-10-09T18:31:43Z","modified":"2024-10-17T06:30:32Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red","level":"critical"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:58:31.969274Z"}],"nvd":[{"id":"CVE-2024-9464","description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.","status":"published","published":"2024-10-09T17:15:20.17Z","modified":"2026-06-17T08:24:37.183Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber","level":"critical","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:31.271525Z"}]}}