CVE-2025-0107

HIGHNuclei

Expedition: OS Command Injection Vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-0107 has a selected CVSS score of 7.7 (high); EIP currently links 1 Nuclei template.

Description

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 25, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 23, 2025 · Source: CVE List

Affected products and versions

5
ProductSourceVersion range

Cloud NGFW

Browse Palo Alto Networks / Cloud NGFW

Default status: unaffected

CVE ListAll versionsunaffected

Expedition

Browse Palo Alto Networks / Expedition

Default status: unaffected

VulnCheck, CVE List1 to < 1.2.100affected

PAN-OS

Browse Palo Alto Networks / PAN-OS

Default status: unaffected

CVE ListAll versionsunaffected

Panorama

Browse Palo Alto Networks / Panorama

Default status: unaffected

CVE ListAll versionsunaffected

Prisma Access

Browse Palo Alto Networks / Prisma Access

Default status: unaffected

CVE ListAll versionsunaffected

Nuclei templates

1
ProjectDiscoveryCRITICALPalo Alto Networks Expedition - OS Command InjectionCVSS 9.8

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Impact

Unauthenticated attackers can execute arbitrary OS commands on Palo Alto Networks Expedition servers, leading to disclosure of sensitive firewall credentials, configurations, and API keys that could compromise all connected PAN-OS firewalls.

Remediation

Upgrade to the latest patched version of Palo Alto Networks Expedition as specified in the vendor security advisory.

Authorsiamnoooob, pdresearch
Template tagscvecve2025rcepaloaltoexpeditionvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Shodan: title:"Expedition"
FOFA: title=="Expedition Project"
https://security.paloaltonetworks.com/PAN-SA-2025-0001 https://ssd-disclosure.com/ssd-advisory-palo-alto-expedition-rce-regionsdiscovery/ https://nvd.nist.gov/vuln/detail/CVE-2025-0107

Source: ProjectDiscovery

References

2