---
title: "Palo Alto Expedition: Exploited Bugs in an EOL Firewall Tool"
url: https://erroneo.us/security/briefs/palo-alto-expedition-cve-2024-5910-9463-9465/
description: "Three exploited Expedition bugs expose stored firewall passwords and API keys. Fixed in 1.2.96, but the tool is end of life. Shut it down and rotate secrets."
type: security-brief
section: "Security Digest"
date_published: 2024-07-10
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-5910", "CVE-2024-9463", "CVE-2024-9465"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Palo Alto Expedition: Exploited Bugs in an EOL Firewall Tool

**Verdict: Check exposure.** Expedition has been end of life since December 31, 2024 and should not be running; if you find one, shut it down and rotate every firewall credential and API key it ever held.

- **Who must act:** Anyone who used Expedition to migrate or tune firewall configs and may still have the VM running, especially if it was reachable from the internet or a broad internal network before 1.2.96.
- **Who can relax:** Organizations that never used Expedition, or that shut it down and rotated the credentials it processed. PAN-OS firewalls, Panorama, Prisma Access and Cloud NGFW are not affected.
- **Affected:** Expedition 1.2 before 1.2.92 (CVE-2024-5910); Expedition before 1.2.96 (CVE-2024-9463, CVE-2024-9465); All Expedition versions: end of life since December 31, 2024, no further fixes
- **Fixed:** Expedition 1.2.92 (CVE-2024-5910); Expedition 1.2.96 (CVE-2024-9463, CVE-2024-9465); Expedition 1.2.101 is the last release with security fixes
- **CVEs:** CVE-2024-5910, CVE-2024-9463, CVE-2024-9465
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Search VM inventories, hypervisors and scan results for any Expedition server that still exists.
2. Shut down and archive any Expedition VM; Palo Alto Networks says it is meant for temporary migration use, not production.
3. Rotate every firewall and Panorama admin password and API key that was ever imported into Expedition.
4. Rotate Expedition's own usernames and passwords, and any shared credentials they reuse.
5. If one must run briefly, use 1.2.101 on an isolated network reachable only from an admin host, then shut it down.

### How to check if you are affected

- Grep /var/apache/log/access.log on the Expedition host for /OS/startup/restore/restoreAdmin.php, /bin/Auth.php, /bin/CronJobs.php and /bin/configurations/parsers/Checkpoint/CHECKPOINT.php.
- Run mysql -uroot -p -D pandb -e "SELECT * FROM cronjobs;" on Expedition; any rows suggest compromise.
- On firewalls whose credentials Expedition held, review config and system logs for admin or API logins from unfamiliar addresses since the credentials were loaded.

## What happened

Expedition is Palo Alto Networks' free tool for migrating and tuning firewall configurations. To do that job it imports device configs, admin usernames and passwords, and API keys for the firewalls it manages. Three of its bugs are in CISA's KEV catalog:

- [CVE-2024-5910](https://security.paloaltonetworks.com/CVE-2024-5910), disclosed July 10, 2024 and fixed in 1.2.92: missing authentication that lets anyone with network access take over the Expedition admin account. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-5910) scores it 9.8.
- [CVE-2024-9463 and CVE-2024-9465](https://security.paloaltonetworks.com/PAN-SA-2024-0010), disclosed October 9, 2024 and fixed in 1.2.96: an unauthenticated OS command injection that runs commands as root, and an unauthenticated SQL injection that dumps the database, including password hashes, device configs and API keys. The vendor scores them 9.9 and 9.2 in CVSS 4.0.

The same day, [Horizon3.ai](https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/) showed that a single unauthenticated request to `/OS/startup/restore/restoreAdmin.php` resets the admin password, and detailed the SQL injection in `CHECKPOINT.php`. It counted about 23 internet-exposed Expedition servers. CISA added CVE-2024-5910 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5910) on November 7, and [CVE-2024-9463](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463) and [CVE-2024-9465](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9465) on November 14. Palo Alto Networks says it learned of the exploitation from CISA. No attacker has been named, [SecurityWeek](https://www.securityweek.com/cisa-warns-of-two-more-palo-alto-expedition-flaws-exploited-in-attacks/) noted, and none had been as of Oct 23, 2026.

## Who is affected

Any Expedition 1 server older than 1.2.96 is vulnerable to all three, and anything below 1.2.92 to the admin takeover. More to the point, Expedition as a whole is finished. The [end-of-life announcement](https://pan.dev/expedition/docs/) covers both the Expedition 1 and Expedition 2 branches, and [PAN-SA-2025-0001](https://security.paloaltonetworks.com/PAN-SA-2025-0001) states that Expedition "reached its End of Life (EoL) date on December 31, 2024." That January 2025 advisory fixed five more bugs in 1.2.100 and 1.2.101, and the vendor said it does "not plan to make any additional updates or security fixes." The firewalls themselves are not affected.

## Do you really need to act?

Only if Expedition is still around, but then yes. These machines often outlive the migration they were built for. A forgotten VM holds working admin credentials and API keys for your firewalls, and any compromise of it hands an attacker the keys to your perimeter. The vendor itself says the tool is "designed to only be used temporarily for migration purposes, not to be run in production." Patching an EOL tool is the wrong fix. Shut it down.

## What to do now

1. Find every Expedition server: check hypervisor inventories and scan results, and on suspect Ubuntu VMs run `ls /var/www/html/OS/startup/restore/`.
2. Collect the logs listed below, then power off and archive the VM.
3. Rotate every firewall and Panorama admin password and API key that was ever imported into Expedition, as the vendor instructs, plus Expedition's own accounts and anything sharing their passwords.
4. If you truly need it for one more migration, run 1.2.101 on an isolated segment reachable only from one admin host, and shut it down afterward.

## How to tell if you were hit

On the Expedition host, Horizon3 points to `/var/apache/log/access.log`. Search it for `restoreAdmin.php`, `/bin/Auth.php`, `/bin/CronJobs.php` and `/bin/configurations/parsers/Checkpoint/CHECKPOINT.php`. The vendor's check for the SQL injection is `mysql -uroot -p -D pandb -e "SELECT * FROM cronjobs;"`; any rows suggest compromise, though an empty result does not prove a clean box. Then check the firewalls whose credentials Expedition held for admin logins, API activity and commits from unexpected addresses in the PAN-OS system and configuration logs.

## Timeline

- Jul 10, 2024 — CVE-2024-5910 disclosed; fixed in 1.2.92.
- Oct 9, 2024 — PAN-SA-2024-0010 fixes CVE-2024-9463 and CVE-2024-9465 in 1.2.96; Horizon3.ai publishes its research.
- Nov 7, 2024 — CISA adds CVE-2024-5910 to KEV.
- Nov 14, 2024 — CISA adds CVE-2024-9463 and CVE-2024-9465.
- Dec 31, 2024 — Expedition reaches end of life.
- Jan 8, 2025 — PAN-SA-2025-0001 ships 1.2.101, the final fixes.

## Sources

1. [Palo Alto Networks — PAN-SA-2024-0010: Multiple Vulnerabilities in Expedition Lead to Exposure of Firewall Credentials](https://security.paloaltonetworks.com/PAN-SA-2024-0010)
2. [Palo Alto Networks — CVE-2024-5910 Expedition: Missing Authentication Leads to Admin Account Takeover](https://security.paloaltonetworks.com/CVE-2024-5910)
3. [Palo Alto Networks — PAN-SA-2025-0001: Multiple Vulnerabilities in Expedition Migration Tool Lead to Exposure of Firewall Credentials](https://security.paloaltonetworks.com/PAN-SA-2025-0001)
4. [Palo Alto Networks — End of Life Announcement for Palo Alto Networks Expedition](https://pan.dev/expedition/docs/)
5. [CVE record — CVE-2024-5910](https://www.cve.org/CVERecord?id=CVE-2024-5910)
6. [CVE record — CVE-2024-9463](https://www.cve.org/CVERecord?id=CVE-2024-9463)
7. [CVE record — CVE-2024-9465](https://www.cve.org/CVERecord?id=CVE-2024-9465)
8. [NVD — CVE-2024-5910](https://nvd.nist.gov/vuln/detail/CVE-2024-5910)
9. [NVD — CVE-2024-9463](https://nvd.nist.gov/vuln/detail/CVE-2024-9463)
10. [NVD — CVE-2024-9465](https://nvd.nist.gov/vuln/detail/CVE-2024-9465)
11. [CISA — Known Exploited Vulnerabilities: CVE-2024-5910](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5910)
12. [CISA — Known Exploited Vulnerabilities: CVE-2024-9463](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463)
13. [CISA — Known Exploited Vulnerabilities: CVE-2024-9465](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9465)
14. [Horizon3.ai — Palo Alto Expedition: From N-Day to Full Compromise](https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/)
15. [SecurityWeek — CISA Warns of Two More Palo Alto Expedition Flaws Exploited in Attacks](https://www.securityweek.com/cisa-warns-of-two-more-palo-alto-expedition-flaws-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/palo-alto-expedition-cve-2024-5910-9463-9465/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt