CVE-2024-5910
Palo Alto Networks Expedition Missing Authentication Vulnerability
Description
CVE-2024-5910 is a critical missing authentication vulnerability in Palo Alto Networks Expedition, a migration and configuration tuning tool, affecting versions 1.2.0 through 1.2.91. Rated 9.8 on the CVSS v3.1 scale, this vulnerability allows an unauthenticated attacker with network access to Expedition to take over the admin account, gaining access to all configuration secrets, credentials, and data imported into the tool. With an EPSS score of 0.91029 (99.6th percentile) and inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2024, this represents a critical risk for organizations using Expedition in their network infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | expedition | >= 1.2.0, < 1.2.92 |
References
- https://security.paloaltonetworks.com/CVE-2024-5910(Vendor Advisory)
- https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5910(US Government Resource)
Weakness Type
The specific CWE classifications for CVE-2024-5910 have not been formally assigned by the vendor. However, the vulnerability is functionally a missing authentication for critical function weakness. The Expedition application exposes a critical administrative function — the ability to reset or take over the admin account — without requiring any authentication. This means any attacker who can reach the Expedition service over the network can directly assume administrative control without needing to provide credentials, exploit a logic flaw, or chain multiple vulnerabilities. This class of weakness is among the most severe because it eliminates the entire authentication layer for the most privileged operation in the application.
Impact Analysis
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) places CVE-2024-5910 at a near-maximum severity with high impact across confidentiality, integrity, and availability. Confidentiality impact is particularly critical because Expedition is specifically designed to handle sensitive network configuration data — firewall rules, VPN configurations, credentials, certificates, and other secrets imported from production Palo Alto Networks devices. An attacker gaining admin access can exfiltrate all of this data. Integrity impact allows the attacker to modify configurations that may later be pushed to production firewalls, potentially creating backdoors or weakening security policies. Availability impact enables the attacker to disrupt the migration and tuning workflows. Business consequences extend far beyond Expedition itself — compromised firewall configurations and credentials can be used to bypass perimeter security, access internal networks, and launch attacks against the organization's entire infrastructure. The EPSS score of 0.91029 (99.6th percentile) reflects near-certain exploitation probability, and detailed exploitation research by Horizon3.ai demonstrates the full attack chain from initial access to complete compromise.
Exploit Maturity
CVE-2024-5910 is confirmed as actively exploited and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2024. The ransomware association is classified as "Unknown." The EPSS score of 0.91029 (99.6th percentile) indicates an extremely high exploitation probability. Horizon3.ai published detailed attack research demonstrating how this vulnerability can be exploited to achieve full compromise of the Expedition instance, including extraction of all stored credentials and configuration data. The availability of this detailed technical writeup, combined with the trivial exploitation requirements (no authentication, no user interaction, low complexity), makes this vulnerability accessible to a wide range of threat actors. Any Expedition instance accessible from the network — whether directly internet-exposed or reachable from an internal network after initial compromise — is at immediate risk.
Remediation
- Upgrade Expedition to version 1.2.92 or later — Apply the fix as described in the Palo Alto Networks security advisory to address the missing authentication vulnerability.
- Restrict network access to Expedition immediately — If patching cannot be performed immediately, isolate the Expedition instance to a management network segment accessible only to authorized administrators via VPN or jump host. Expedition should never be accessible from the general network or the internet.
- Rotate all credentials stored in Expedition — Assume that any credentials, certificates, API keys, or configuration secrets imported into Expedition have been compromised. Rotate these credentials on all production firewalls and systems that were managed through Expedition.
- Audit Expedition access logs and configurations — Review all login attempts, configuration changes, and data exports in Expedition. Check whether any configurations were modified or exported by unauthorized parties, and verify that firewall rules pushed from Expedition have not been tampered with.
- Evaluate the need for Expedition in your environment — Palo Alto Networks has announced the end-of-life for Expedition. Plan migration away from Expedition and ensure that any replacement tools implement proper authentication controls for administrative functions.
Technical Details
The CVSS v3.1 vector for CVE-2024-5910 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 9.8 (Critical). Attack Vector (Network) means the vulnerability is exploitable from any network position that can reach the Expedition service. Attack Complexity (Low) confirms the attack is straightforward and reliable. Privileges Required (None) and User Interaction (None) confirm this is a fully unauthenticated attack requiring no victim cooperation. Scope (Unchanged) limits the direct impact to the Expedition application, though the secondary impact through compromised credentials extends much further. Confidentiality, Integrity, and Availability (all High) reflect complete control over the Expedition instance and all its data. The attack mechanism exploits a critical function in Expedition that allows admin account takeover without any authentication check. The specific function — likely an account reset or initialization endpoint — is accessible to any user with network connectivity to the Expedition service. Once admin access is obtained, the attacker has full control over the application, including the ability to view and export all imported configurations, credentials, firewall rules, and certificates from Palo Alto Networks devices.
Frequently Asked Questions
What is CVE-2024-5910?
CVE-2024-5910 is a critical missing authentication vulnerability in Palo Alto Networks Expedition, a tool used for firewall configuration migration and tuning. It allows any unauthenticated attacker with network access to take over the Expedition admin account and access all stored configuration data and credentials.
What data is at risk from CVE-2024-5910?
Expedition stores firewall configurations, VPN credentials, certificates, API keys, and other sensitive data imported from Palo Alto Networks devices. A compromised Expedition instance exposes all of this data, potentially enabling attackers to bypass firewall security, access internal networks, and compromise production infrastructure.
Is CVE-2024-5910 being actively exploited?
Yes, CISA has confirmed active exploitation and detailed attack research by Horizon3.ai demonstrates the full exploitation chain. With an EPSS score in the 99.6th percentile, this vulnerability is among the most likely to be exploited across all known CVEs.
How do I protect against CVE-2024-5910?
Upgrade Expedition to version 1.2.92 or later immediately. Restrict network access to the Expedition instance, rotate all credentials that were stored in or processed by Expedition, and plan for migration away from Expedition given its announced end-of-life.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.