CVE-2024-9463
Published: 09 October 2024
Summary
CVE-2024-9463 is a critical-severity OS Command Injection (CWE-78) vulnerability in Paloaltonetworks Expedition. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-9463 is an OS command injection vulnerability, tracked under CWE-78, that affects Palo Alto Networks Expedition. The flaw permits unauthenticated remote attackers to execute arbitrary operating system commands with root privileges on the Expedition instance, directly exposing usernames, cleartext passwords, device configurations, and API keys belonging to managed PAN-OS firewalls.
An attacker can exploit the issue over the network without authentication or user interaction, achieving full control of the Expedition host and harvesting the enumerated credentials and configuration data that can then be used to compromise associated PAN-OS devices.
Palo Alto Networks published advisory PAN-SA-2024-0010 detailing remediation steps, and the vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog, confirming that mitigations and patches should be applied promptly.
The EPSS score has remained at a high level, with a recorded peak of 0.9623 and a current value of 0.9420, underscoring sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49955
Vulnerability details
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
- CWE(s)
- KEV Date Added
- 14 November 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of inputs to block OS command injection payloads before they reach the Expedition shell.
Enforces least privilege so that even a successful injection cannot yield unrestricted root execution on the Expedition host.
Mandates timely application of vendor patches that close the unauthenticated command-injection flaw described in PAN-SA-2024-0010.