The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability in Palo Alto Networks’ Expedition tool, which could lead to severe security breaches.
The vulnerability, CVE-2024-5910, is classified as a “Missing Authentication” flaw that potentially allows attackers with network access to take control of an Expedition admin account.
According to CISA’s alert, this could allow cybercriminals to access sensitive configuration data, including credentials and other highly privileged information.
Build an in-house SOC or outsource SOC-as-a-Service -> Calculate Costs
CVE-2024-5910 is linked to CWE-306 (Missing Authentication for Critical Function), a common weakness caused by an application not adequately verifying user credentials before granting access to sensitive functions.
In the case of Palo Alto Networks’ Expedition—a tool used for firewall migration and configuration analysis—the vulnerability could enable attackers to hijack the administrative interface and gain access to configuration secrets.
While it is yet to be confirmed whether this vulnerability has been actively exploited in ransomware campaigns, CISA has urged all organizations using Palo Alto Expedition to take immediate action.
“The risk of this vulnerability being leveraged in targeted attacks is significant due to the high level of access it grants to attackers,” the advisory notes.
CISA has strongly advised organizations to apply the recommended mitigations outlined by Palo Alto Networks.
If mitigations are unavailable or impractical, CISA recommends discontinuing the product’s use to avoid potential compromise. The deadline for addressing this vulnerability is November 28, 2024.
Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…