Expedition
CVE-2025-0107
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.7, EPSS 79.8%. Expedition instances typically contain credentials for the organization's entire PAN-OS firewall fleet. Compromising Expedition provides immediate access to firewall admin credentials, device configurations (including VPN settings and security policies), and API keys that can be used to reconfigure firewalls remotely. |
| Exploit ScenarioDerived | An attacker discovers an Expedition instance exposed on the network. They exploit the command injection to dump the Expedition database, extracting PAN-OS admin credentials and API keys for 50+ firewalls. Using the API keys, they modify firewall rules to create covert access paths, exfiltrate VPN configurations for persistent remote access, and disable security logging. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
Palo Alto Networks Expedition contains an unauthenticated OS command injection vulnerability that allows attackers to execute arbitrary commands as the www-data user. Successful exploitation exposes firewall usernames, cleartext passwords, device configurations, and API keys for PAN-OS managed firewalls.
Earlier versions of this analysis (1)
Unauthenticated OS command injection in Palo Alto Expedition exposes PAN-OS firewall credentials, configurations, and API keys.
RemediationAI
Palo Alto Networks has announced Expedition end-of-life. Migrate away from Expedition immediately. Rotate all PAN-OS admin credentials and API keys that were stored in Expedition. Restrict network access to Expedition instances. Monitor PAN-OS firewalls for unauthorized configuration changes.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Palo Alto Expedition (formerly Migration Tool) is used to migrate firewall configurations from other vendors to PAN-OS. The application stores PAN-OS firewall credentials, device configurations, and API keys in its database. The command injection vulnerability allows unauthenticated attackers to execute commands as the www-data user, which has read access to the Expedition database and configuration files.
Know when Expedition gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Green
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
Executive ViewAI
CVE-2025-0107 presents notable security risk, a OS command injection vulnerability rated CVSS 7.7. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. With an EPSS score of 80%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Expedition
View allMissing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitra
The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote a
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition
An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML
A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated atta
The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operat
A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context
A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate file
GitHub PoC
Exploit-DB