A critical Palo Alto Networks bug is being hit by cyberattacks, so patch now

CISA flags a new flaw to KEV

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

A critical bug found in Palo Alto Networks’ Expedition program is being abused in the wild, the US government has warned.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-5910 to its Known Exploited Vulnerabilities (KEV) catalog, which means there is evidence of abuse in the wild.

This vulnerability, discovered in Expedition in the summer of 2023, is described as a “missing authentication for a critical function” bug, which can lead to Expedition admin account takeover for crooks with network access. Since Expedition is a tool that helps with configuration migration, tuning, and enrichment, it may contain secrets, credentials, and other data, which would then be at risk of theft.

Proof of concept

Users are advised to apply a patch immediately, since the vulnerability allows threat actors to take over admin accounts, steal sensitive data, and more.

When CISA adds a vulnerability to KEV, it gives federal agencies a deadline to patch it, or stop using the afflicted applications completely. The due date for Palo Alto Networks Expedition is November 28, 2024.

CISA did not share any further details about the attacks, butBleepingComputerdug up a report from Horizon3.ai, who released a proof-of-concept exploit in October 2024. By chaining the bug with CVE-2024-9464, crooks could gain unauthenticated arbitrary command execution capabilities on vulnerable Expedition servers.

This additional vulnerability was also discovered, and patched, last month. Palo Alto Networks said it could have been used to take over admin accounts in firewalls, and take over PAN-OS instances.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

For those unable to install the patch immediately, a workaround is available, which includes restricting Expedition network access to authorized users, hosts, and networks, only.

“All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating,” Palo Alto Networks concluded.

ViaBleepingComputer

You might also like

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Nokia confirms data breach leaked third-party code, but its data is safe

Rising AI threats are making firms turn back to human intelligence

3 reasons why PIA fell in our best VPN rankings