CVE-2025-0107
Full vulnerability record from the local CVENow database.
Description
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
Severity
HIGH
CVSS score
7.7
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-01-11 03:15:22.637000
Last modified
2026-11-03 22:17:30.753000
View original CVE JSON
{
"id": "CVE-2025-0107",
"sourceIdentifier": "[email protected]",
"published": "2025-01-11T03:15:22.637",
"lastModified": "2026-11-03T22:17:30.753",
"vulnStatus": "Analyzed",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software."
},
{
"lang": "es",
"value": "Una vulnerabilidad de inyección de comandos del sistema operativo en Palo Alto Networks Expedition permite a un atacante autenticado ejecutar comandos del sistema operativo arbitrarios como el usuario www-data en Expedition, lo que resulta en la divulgación de nombres de usuario, contraseñas de texto plano, configuraciones de dispositivos y claves API de dispositivos para firewalls que ejecutan software PAN-OS."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Palo Alto Networks",
"product": "Cloud NGFW",
"defaultStatus": "unaffected",
"versions": [
{
"version": "All",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "Expedition",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1",
"lessThan": "1.2.100",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "1.2.100",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "Panorama",
"defaultStatus": "unaffected",
"versions": [
{
"version": "All",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "PAN-OS",
"defaultStatus": "unaffected",
"versions": [
{
"version": "All",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "Prisma Access",
"defaultStatus": "unaffected",
"versions": [
{
"version": "All",
"versionType": "custom",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Green",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "CONCENTRATED",
"vulnerabilityResponseEffort": "HIGH",
"providerUrgency": "GREEN"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-08-14T21:06:09.775278Z",
"id": "CVE-2025-0107",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:expedition:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.101",
"matchCriteriaId": "BD4811AB-AC99-4D98-82AA-EB2237522C4C"
}
]
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/PAN-SA-2025-0001",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}