CVE-2024-5910

A critical function in the Expedition application does not require authentication (CWE-306 — Missing Authentication for Critical Function), which means that any attacker with network access to the system can invoke it directly. This results in the possibility of taking over the Expedition administrator account without knowledge of any login credentials. Since Expedition is used for migration, fine-tuning, and enrichment of network device configurations, the tool may store passwords, keys, configuration secrets, and other imported authentication data.

An attacker can fully take over the Expedition administrator account, and consequently gain access to sensitive configuration data, secrets, credentials, and other information imported into this tool, which may lead to further compromise of network infrastructure.

Apply patches available from the vendor in accordance with the references (https://security.paloaltonetworks.com/CVE-2024-5910). Additionally, it is recommended to restrict network access to the Expedition interface exclusively to trusted hosts/networks and immediately verify whether credentials stored in Expedition have been compromised.

Palo Alto Networks Expedition — versions specified in vendor references (https://security.paloaltonetworks.com/CVE-2024-5910)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.