Thursday, April 10, 2025
HomeCVE/vulnerabilityPalo Alto Networks Expedition Tool Vulnerability Let Attackers Access Cleartext Passwords

Palo Alto Networks Expedition Tool Vulnerability Let Attackers Access Cleartext Passwords

Published on

SIEM as a Service

Follow Us on Google News

A series of serious vulnerabilities have been identified in Palo Alto Networks’ Expedition migration tool, which could allow attackers to gain unauthorized access to sensitive data, including cleartext passwords and device configurations.

The vulnerabilities, detailed in multiple Common Vulnerabilities and Exposures (CVE) reports, highlight significant risks for organizations using this tool for transitioning to Palo Alto Networks’ next-generation firewall (NGFW) platform.

Overview of Expedition Tool

Expedition, formerly known as the Migration Tool, is a free utility designed solely for facilitating the migration of firewall configurations from other vendors to Palo Alto Networks’ systems.

- Advertisement - Google News

It is not intended for production use and is meant to serve as a temporary workspace for security policy optimization.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

Notably, Expedition reached its End of Life (EoL) on December 31, 2024, and users are encouraged to transition to alternative tools as outlined in the EoL announcement.

Details of Vulnerabilities

The identified vulnerabilities span several categories and severities, ranging from SQL injection to command injection.

These flaws could potentially compromise the confidentiality and integrity of data stored within the Expedition tool. Below is a summary of the critical vulnerabilities:

CVECVSS ScoreSummary
CVE-2025-01037.8SQL injection vulnerability allowing attackers to read database contents and create files.
CVE-2025-01044.7SQL injection vulnerability allows attackers to read database contents and create files.
CVE-2025-01052.7Arbitrary file deletion vulnerability accessible to unauthenticated attackers.
CVE-2025-01062.7Wildcard expansion vulnerability for file enumeration on the host filesystem.
CVE-2025-01072.3OS command injection allowing execution of arbitrary commands as the www-data user.

While Palo Alto Networks has not reported any known exploitation of these vulnerabilities, the potential for data breaches or further attacks underscores the importance of addressing these issues promptly. Users of Expedition are strongly advised to:

  1. Update to the latest version: Ensure that you’re running Expedition version 1.2.101 or later to mitigate these vulnerabilities.
  2. Evaluate alternatives: Given the EoL status of Expedition, consider transitioning to other approved migration tools that align with your security needs.
  3. Monitor your systems: Regularly check logs and alerts for any unusual activities that may suggest an attempted exploitation of these vulnerabilities.

Organizations utilizing the Palo Alto Networks Expedition tool should take immediate steps to protect their data and maintain the integrity of their security policies.

By staying informed and proactive, users can help safeguard their systems against potential threats arising from these vulnerabilities.

Find this News Interesting! Follow us on Google NewsLinkedIn, and X to Get Instant Updates!

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Dell Alerts Users to Critical PowerScale OneFS Flaws Enabling Account Takeover

Dell Technologies has issued an urgent security advisory to its users, warning of several...

SonicWall Patches Multiple Vulnerabilities in NetExtender Windows Client

SonicWall has issued a critical alert concerning multiple vulnerabilities discovered in its NetExtender Windows...

Cable: Powerful Post-Exploitation Toolkit for Active Directory Attacks

Cybersecurity researchers are raising alarms about Cable, a potent open-source post-exploitation toolkit designed to exploit...

Langflow AI Builder Vulnerability Allows Remote Server Takeover by Attackers

A critical security vulnerability has been discovered in the Langflow AI Builder, a popular...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Dell Alerts Users to Critical PowerScale OneFS Flaws Enabling Account Takeover

Dell Technologies has issued an urgent security advisory to its users, warning of several...

SonicWall Patches Multiple Vulnerabilities in NetExtender Windows Client

SonicWall has issued a critical alert concerning multiple vulnerabilities discovered in its NetExtender Windows...

Cable: Powerful Post-Exploitation Toolkit for Active Directory Attacks

Cybersecurity researchers are raising alarms about Cable, a potent open-source post-exploitation toolkit designed to exploit...