What is CVE-2024-5910?

CVE-2024-5910 is a critical missing authentication vulnerability in Palo Alto Networks Expedition, a tool used for firewall configuration migration and tuning. It allows any unauthenticated attacker with network access to take over the Expedition admin account and access all stored configuration data and credentials.

What data is at risk from CVE-2024-5910?

Expedition stores firewall configurations, VPN credentials, certificates, API keys, and other sensitive data imported from Palo Alto Networks devices. A compromised Expedition instance exposes all of this data, potentially enabling attackers to bypass firewall security, access internal networks, and compromise production infrastructure.

Is CVE-2024-5910 being actively exploited?

Yes, CISA has confirmed active exploitation and detailed attack research by Horizon3.ai demonstrates the full exploitation chain. With an EPSS score in the 99.6th percentile, this vulnerability is among the most likely to be exploited across all known CVEs.

How do I protect against CVE-2024-5910?

Upgrade Expedition to version 1.2.92 or later immediately. Restrict network access to the Expedition instance, rotate all credentials that were stored in or processed by Expedition, and plan for migration away from Expedition given its announced end-of-life.

CVE-2024-5910

CRITICAL(9.8)KEVLikely Exploited

Palo Alto Networks Expedition Missing Authentication Vulnerability

Description

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.

KEV Information

Vendor

Palo Alto Networks

Product

Expedition

Date Added

November 7, 2024

Due Date

November 28, 2024

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CWEs

CWE-306Missing Authentication

Missing Authentication for Critical Function

Affected Products

Vendor	Product	Version
paloaltonetworks	expedition	>= 1.2.0, < 1.2.92

References

https://security.paloaltonetworks.com/CVE-2024-5910(Vendor Advisory)
https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise(Exploit, Third Party Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5910(US Government Resource)

CVSS Score

9.8

CRITICAL(9.8)

EPSS Score

EPSS Score91.78%

EPSS Percentile99.8%

Dates

PublishedJuly 10, 2024

Last ModifiedJune 17, 2026

StatusAnalyzed

CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch

CVE-2024-5910

Description

KEV Information

CVSS Score

CWEs

Affected Products

References

CVSS Score

EPSS Score

Dates

Quick Links

Need Help With Vulnerability Management?

Platform

Resources

Company

Latest Articles