CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability in Palo Alto Networks’ Expedition tool, which could lead to severe security breaches.

The vulnerability, CVE-2024-5910, is classified as a “Missing Authentication” flaw that potentially allows attackers with network access to take control of an Expedition admin account.

According to CISA’s alert, this could allow cybercriminals to access sensitive configuration data, including credentials and other highly privileged information.

Build an in-house SOC or outsource SOC-as-a-Service -> Calculate Costs

CVE-2024-5910 – Vulnerability Details

CVE-2024-5910 is linked to CWE-306 (Missing Authentication for Critical Function), a common weakness caused by an application not adequately verifying user credentials before granting access to sensitive functions.

In the case of Palo Alto Networks’ Expedition—a tool used for firewall migration and configuration analysis—the vulnerability could enable attackers to hijack the administrative interface and gain access to configuration secrets. 

While it is yet to be confirmed whether this vulnerability has been actively exploited in ransomware campaigns, CISA has urged all organizations using Palo Alto Expedition to take immediate action.

“The risk of this vulnerability being leveraged in targeted attacks is significant due to the high level of access it grants to attackers,” the advisory notes.

CISA has strongly advised organizations to apply the recommended mitigations outlined by Palo Alto Networks.

If mitigations are unavailable or impractical, CISA recommends discontinuing the product’s use to avoid potential compromise. The deadline for addressing this vulnerability is November 28, 2024.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!