{"id":"CVE-2024-5910","published":"2024-07-10T19:15:11Z","modified":"2026-06-17T08:16:53Z","title":"Palo Alto Networks Expedition Missing Authentication Vulnerability","vendor":"Palo Alto Networks","product":"Expedition","tier":"core","eol":null,"description":{"text":"Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.\n\nNote: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.","provenance":"source","from":"NVD"},"summary":{"text":"Palo Alto Networks Expedition contains a missing authentication flaw in a critical function, which is classified under missing authentication for critical functionality. An attacker with network access to Expedition, requiring no credentials and no user interaction, can take over an Expedition admin account, putting configuration secrets, credentials, and other data imported into the tool at risk.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:58Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.91684,"percentile":0.99814,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-11-07","dueDate":"2024-11-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://security.paloaltonetworks.com/CVE-2024-5910 ; https://nvd.nist.gov/vuln/detail/CVE-2024-5910","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-11-07","exploitedFirstSeen":"2024-11-07","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-11-07"},{"url":"https://www.fortiguard.com/outbreak-alert/palo-alto-expedition-vulnerability","date":"2024-11-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-16&host_type=src&vulnerability=cve-2024-5910","date":"2024-12-16"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","date":"2025-02-27"},{"url":"https://www.crowdstrike.com/explore/2025-global-threat-report","date":"2025-02-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-03&host_type=src&vulnerability=cve-2024-5910","date":"2025-04-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-02&host_type=src&vulnerability=cve-2024-5910","date":"2026-07-02"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2024-5910","tags":["Vendor Advisory"]},{"url":"https://security.paloaltonetworks.com/CVE-2024-5910","tags":["Vendor Advisory"]},{"url":"https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5910","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated network access to public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Missing authentication for a critical function in Palo Alto Networks Expedition","start":0,"end":79}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: admin account takeover grants valid credentials","mappingType":"primary_impact","evidence":[{"from":"description","quote":"can lead to an Expedition admin account takeover","start":80,"end":128}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-47042","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47042","exploited":true,"exploitedSince":"2024-11-07","provenance":"source"},"exploits":[{"id":52129,"url":"https://www.exploit-db.com/exploits/52129","title":"Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover","type":"webapps","platform":"multiple","date":"2025-04-06","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-04-06"},"metasploit":[{"name":"Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)","module":"exploit/linux/http/paloalto_expedition_rce","type":"exploit","disclosureDate":"2024-10-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/paloalto_expedition_rce.rb"}],"nuclei":[{"id":"CVE-2024-5910","name":"Palo Alto Expedition - Admin Account Takeover","severity":"critical","path":"http/cves/2024/CVE-2024-5910.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5910.yaml"}],"first":{"date":"2024-10-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/paloalto_expedition_rce.rb"},"provenance":"source"},"exploitRefs":["https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2024-07-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5910","provenance":"source"},{"date":"2024-10-09","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2025-04-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/paloalto_expedition_rce.rb","provenance":"source"},{"date":"2024-11-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2024-11-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-11-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47042","provenance":"source"}],"speed":{"daysToPublicExploit":91,"firstExploitFrom":"Metasploit","daysToKev":120},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 722 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9981"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}