{"id":"CVE-2025-0107","published":"2025-01-11T03:02:49Z","modified":"2025-01-24T04:56:01Z","title":"Expedition: OS Command Injection Vulnerability","vendor":"Palo Alto Networks","product":"Cloud NGFW","tier":"core","eol":null,"affectedVersions":[{"vendor":"Palo Alto Networks","product":"Expedition","versions":[">= 1, < 1.2.100"]}],"description":{"text":"An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.","provenance":"source","from":"CVE.org"},"summary":{"text":"An OS command injection flaw in Palo Alto Networks Expedition, a component associated with Cloud NGFW, lets an attacker execute arbitrary operating system commands as the www-data user. An unauthenticated attacker with network access can exploit it without credentials or user interaction, and the resulting exposure includes usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T22:21:55Z"},"cvss":{"score":7.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Green","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.78416,"percentile":0.99583,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-06-25","exploitedFirstSeen":"2025-06-25","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-0107","date":"2025-06-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-15&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-16&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-18&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-19&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-21&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-22&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-23&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-24&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-25&host_type=src&vulnerability=cve-2025-0107","date":"2026-01-25"}],"evidenceTotal":163,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://security.paloaltonetworks.com/PAN-SA-2025-0001","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-1504","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1504","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-0107","name":"Palo Alto Networks Expedition - OS Command Injection","severity":"critical","path":"http/cves/2025/CVE-2025-0107.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0107.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-01-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-0107","provenance":"source"},{"date":"2025-06-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-0107","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":65.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 493 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9958"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.39,"detail":"base score 7.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}