CVE-2025-0107
HIGH
ACT NOW
Priority: 6.04
BB Relevance:
85/100
Published: 2025-01-11
Modified: 2026-11-04
First seen: 2026-11-03
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
None
VC:
Low
VI:
Low
VA:
Low
Description
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Palo Alto Networks | Expedition | 1 < 1.2.100 |
| Palo Alto Networks | Expedition | 1 < 1.2.100 |
| paloaltonetworks | expedition | < 1.2.101 |
References & Advisories (1)
vendor-advisory