PT-2024-6883

CVE-2024-9464

Published

2024-10-09

Updated

2024-11-20

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition (affected versions not specified)

Description An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition. This results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. The vulnerability is related to the failure to neutralize special elements used in the OS command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Enrique Castillo

Hacks_Zach

Zach Hanley

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')