Palo Alto Networks Expedition Missing Authentication Vulnerability

cve CVE-2024-5910 3 sources, 3 claims · Watch

CISA Known Exploited Vulnerabilities writes:
Palo Alto Networks Expedition Missing Authentication Vulnerability Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910 the claim

What each source says

PropertySourceSaidMeans here
Author
author
Exploit-DBByteHunter
receipt
Source
Exploit-DB
Its words
ByteHunter
Read by
field:author
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "ByteHunter",
  "codes": "CVE-2024-5910",
  "date_added": "2025-04-06",
  "date_published": "2025-04-06",
  "date_updated": "2025-04-13",
  "description": "Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover",
  "file": "exploits/multiple/webapps/52129.py",
  "id": "52129",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "webapps",
  "verified": "0"
}
—
Cwes
cwes
CISA Known Exploited VulnerabilitiesCWE-306
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
CWE-306
Read by
field:cwes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:00 UTC
What the source handed over
{
  "cveID": "CVE-2024-5910",
  "cwes": "CWE-306",
  "dateAdded": "2024-11-07",
  "dueDate": "2024-11-28",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910",
  "product": "Expedition",
  "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.",
  "vendorProject": "Palo Alto Networks",
  "vulnerabilityName": "Palo Alto Networks Expedition Missing Authentication Vulnerability"
}
—
Due date
due_date
CISA Known Exploited Vulnerabilities2024-11-28
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
2024-11-28
Read by
field:dueDate
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:00 UTC
What the source handed over
{
  "cveID": "CVE-2024-5910",
  "cwes": "CWE-306",
  "dateAdded": "2024-11-07",
  "dueDate": "2024-11-28",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910",
  "product": "Expedition",
  "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.",
  "vendorProject": "Palo Alto Networks",
  "vulnerabilityName": "Palo Alto Networks Expedition Missing Authentication Vulnerability"
}
—
Exploited
exploited
CISA Known Exploited Vulnerabilitiesyes
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
yes
Read by
const:yes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:00 UTC
What the source handed over
{
  "cveID": "CVE-2024-5910",
  "cwes": "CWE-306",
  "dateAdded": "2024-11-07",
  "dueDate": "2024-11-28",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910",
  "product": "Expedition",
  "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.",
  "vendorProject": "Palo Alto Networks",
  "vulnerabilityName": "Palo Alto Networks Expedition Missing Authentication Vulnerability"
}
—
Forensic triage
forensic_triage
CISA Known Exploited Vulnerabilitiesfalse
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
No
Read by
field:forensicTriage
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:00 UTC
What the source handed over
{
  "cveID": "CVE-2024-5910",
  "cwes": "CWE-306",
  "dateAdded": "2024-11-07",
  "dueDate": "2024-11-28",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910",
  "product": "Expedition",
  "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.",
  "vendorProject": "Palo Alto Networks",
  "vulnerabilityName": "Palo Alto Networks Expedition Missing Authentication Vulnerability"
}
—
Known ransomware campaign use
known_ransomware_campaign_use
CISA Known Exploited VulnerabilitiesUnknown
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Unknown
Read by
field:knownRansomwareCampaignUse
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:00 UTC
What the source handed over
{
  "cveID": "CVE-2024-5910",
  "cwes": "CWE-306",
  "dateAdded": "2024-11-07",
  "dueDate": "2024-11-28",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910",
  "product": "Expedition",
  "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.",
  "vendorProject": "Palo Alto Networks",
  "vulnerabilityName": "Palo Alto Networks Expedition Missing Authentication Vulnerability"
}
—
Platform
platform
not compared		Exploit-DBmultiple
receipt
Source
Exploit-DB
Its words
multiple
Read by
field:platform
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "ByteHunter",
  "codes": "CVE-2024-5910",
  "date_added": "2025-04-06",
  "date_published": "2025-04-06",
  "date_updated": "2025-04-13",
  "description": "Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover",
  "file": "exploits/multiple/webapps/52129.py",
  "id": "52129",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "webapps",
  "verified": "0"
}
—
Platform
platform
not compared		Metasploit exploit modulesLinux,Unix
receipt
Source
Metasploit exploit modules
Its words
Linux,Unix
Read by
field:platform
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 16:59 UTC
Original
open at the source
What the source handed over
{
  "aliases": [],
  "arch": "cmd",
  "author": [
    "Michael Heinzl",
    "Zach Hanley",
    "Enrique Castillo",
    "Brian Hysell"
  ],
  "autofilter_ports": [
    80,
    8080,
    443,
    8000,
    8888,
    8880,
    8008,
    3000,
    8443
  ],
  "autofilter_services": [
    "http",
    "https"
  ],
  "check": true,
  "default_credential": false,
  "description": "Obtain remote code execution in Palo Alto Expedition version 1.2.91 and below.\n          The first vulnerability, CVE-2024-5910, allows to reset the password of the admin user, and the second vulnerability, CVE-2024-9464, is an authenticated OS command injection. In a default installation, commands will get executed in the context of www-data.\n          When credentials are provided, this module will only exploit the second vulnerability. If no credentials are provided, the module will first try to reset the admin password and then perform the OS command injection.",
  "disclosure_date": "2024-10-09",
  "fullname": "exploit/linux/http/paloalto_expedition_rce",
  "is_install_path": true,
  "mod_time": "2026-06-02 10:32:30 +0000",
  "name": "Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)",
  "needs_cleanup": true,
  "notes": {
    "Reliability": [
      "repeatable-session"
    ],
    "SideEffects": [
      "ioc-in-logs",
      "artifacts-on-disk",
      "account-lockouts"
    ],
    "Stability": [
      "crash-safe"
    ]
  },
  "path": "/modules/exploits/linux/http/paloalto_expedition_rce.rb",
  "platform": "Linux,Unix",
  "post_auth": false,
  "rank": 600,
  "ref_name": "linux/http/paloalto_expedition_rce",
  "references": [
    "URL-https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/",
    "URL-https://security.paloaltonetworks.com/PAN-SA-2024-0010",
    "URL-https://security.paloaltonetworks.com/CVE-2024-5910",
    "URL-https://attackerkb.com/topics/JwTzQJuBmn/cve-2024-5910",
    "URL-https://attackerkb.com/topics/ky1MIrne9r/cve-2024-9464",
    "CVE-2024-5910",
    "EDB-52129",
    "CVE-2024-24809"
  ],
  "rport": 443,
  "session_types": false,
  "targets": [
    "Linux Command"
  ],
  "type": "exploit"
}
—
Product
product
CISA Known Exploited VulnerabilitiesExpedition
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Expedition
Read by
field:product
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:00 UTC
What the source handed over
{
  "cveID": "CVE-2024-5910",
  "cwes": "CWE-306",
  "dateAdded": "2024-11-07",
  "dueDate": "2024-11-28",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910",
  "product": "Expedition",
  "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.",
  "vendorProject": "Palo Alto Networks",
  "vulnerabilityName": "Palo Alto Networks Expedition Missing Authentication Vulnerability"
}
—
Rank
rank
Metasploit exploit modules600
Excellent. Cannot crash the service. A memory-corruption exploit does not qualify.
receipt
Source
Metasploit exploit modules
Its words
600
Read by
field:rank
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 16:59 UTC
Original
open at the source
What the source handed over
{
  "aliases": [],
  "arch": "cmd",
  "author": [
    "Michael Heinzl",
    "Zach Hanley",
    "Enrique Castillo",
    "Brian Hysell"
  ],
  "autofilter_ports": [
    80,
    8080,
    443,
    8000,
    8888,
    8880,
    8008,
    3000,
    8443
  ],
  "autofilter_services": [
    "http",
    "https"
  ],
  "check": true,
  "default_credential": false,
  "description": "Obtain remote code execution in Palo Alto Expedition version 1.2.91 and below.\n          The first vulnerability, CVE-2024-5910, allows to reset the password of the admin user, and the second vulnerability, CVE-2024-9464, is an authenticated OS command injection. In a default installation, commands will get executed in the context of www-data.\n          When credentials are provided, this module will only exploit the second vulnerability. If no credentials are provided, the module will first try to reset the admin password and then perform the OS command injection.",
  "disclosure_date": "2024-10-09",
  "fullname": "exploit/linux/http/paloalto_expedition_rce",
  "is_install_path": true,
  "mod_time": "2026-06-02 10:32:30 +0000",
  "name": "Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)",
  "needs_cleanup": true,
  "notes": {
    "Reliability": [
      "repeatable-session"
    ],
    "SideEffects": [
      "ioc-in-logs",
      "artifacts-on-disk",
      "account-lockouts"
    ],
    "Stability": [
      "crash-safe"
    ]
  },
  "path": "/modules/exploits/linux/http/paloalto_expedition_rce.rb",
  "platform": "Linux,Unix",
  "post_auth": false,
  "rank": 600,
  "ref_name": "linux/http/paloalto_expedition_rce",
  "references": [
    "URL-https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/",
    "URL-https://security.paloaltonetworks.com/PAN-SA-2024-0010",
    "URL-https://security.paloaltonetworks.com/CVE-2024-5910",
    "URL-https://attackerkb.com/topics/JwTzQJuBmn/cve-2024-5910",
    "URL-https://attackerkb.com/topics/ky1MIrne9r/cve-2024-9464",
    "CVE-2024-5910",
    "EDB-52129",
    "CVE-2024-24809"
  ],
  "rport": 443,
  "session_types": false,
  "targets": [
    "Linux Command"
  ],
  "type": "exploit"
}
—
Type
type
Exploit-DBwebapps
receipt
Source
Exploit-DB
Its words
webapps
Read by
field:type
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "ByteHunter",
  "codes": "CVE-2024-5910",
  "date_added": "2025-04-06",
  "date_published": "2025-04-06",
  "date_updated": "2025-04-13",
  "description": "Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover",
  "file": "exploits/multiple/webapps/52129.py",
  "id": "52129",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "webapps",
  "verified": "0"
}
—
Vendor project
vendor_project
CISA Known Exploited VulnerabilitiesPalo Alto Networks
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Palo Alto Networks
Read by
field:vendorProject
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:00 UTC
What the source handed over
{
  "cveID": "CVE-2024-5910",
  "cwes": "CWE-306",
  "dateAdded": "2024-11-07",
  "dueDate": "2024-11-28",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910",
  "product": "Expedition",
  "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.",
  "vendorProject": "Palo Alto Networks",
  "vulnerabilityName": "Palo Alto Networks Expedition Missing Authentication Vulnerability"
}
—
Verified
verified
Exploit-DBfalse
receipt
Source
Exploit-DB
Its words
0
Read by
field:verified
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "ByteHunter",
  "codes": "CVE-2024-5910",
  "date_added": "2025-04-06",
  "date_published": "2025-04-06",
  "date_updated": "2025-04-13",
  "description": "Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover",
  "file": "exploits/multiple/webapps/52129.py",
  "id": "52129",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "webapps",
  "verified": "0"
}
—

vulnerability

Palo Alto Networks Expedition Missing Authentication Vulnerability
zetlyn/cve-kev · 2024-11-07
cwes CWE-306 due_date 2024-11-28 exploited yes forensic_triage false known_ransomware_campaign_use Unknown product Expedition vendor_project Palo Alto Networks

exploit

Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)
zetlyn/cve-metasploit · 2024-10-09
platform Linux,Unix rank 600 source
Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
zetlyn/cve-exploitdb · 2025-04-06
author ByteHunter platform multiple type webapps verified false source