Wednesday , May 14 2025
Expedition

Palo Alto Networks Expedition Tool Vuln Lead to Exposure of Firewall Credentials

Palo Alto Networks released a security advisory about vulnerabilities in its Expedition migration tool that could expose sensitive data and enable unauthorized actions on affected systems.

Expedition, formerly the Migration Tool, is a free tool that helps users migrate to the Palo Alto Networks NGFW platform and provides a temporary workspace to optimize security policies.

CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE

Siemens issued a security advisory (SSA-047424) for two serious vulnerabilities—CVE-2025-26389 and CVE-2025-26390—impacting the OZW672 and OZW772 web servers. These servers...
Read More
CVSS 10.0 Flaw  Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE

Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day

Microsoft has released its Patch Tuesday updates for May 2025, addressing a total of 78 vulnerabilities across its product ecosystem,...
Read More
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day

OTP glitch disrupted NID services across the country

NID services in Bangladesh are temporarily suspended due to issues with delivering One-Time Passwords (OTP) needed to access the NID...
Read More
OTP glitch disrupted NID services across the country

Google to pay Texas $1.4 billion for location tracking practices

Google will pay about $1.4 billion to Texas to settle two lawsuits regarding location tracking and biometric data storage without...
Read More
Google to pay Texas $1.4 billion for location tracking practices

YouTube geo-blocks at least 4 Bangladeshi TV channels in India

YouTube has restricted access to at least four Bangladeshi television channels in India following a takedown request from the Indian...
Read More
YouTube geo-blocks at least 4 Bangladeshi TV channels in India

Microsoft Patches Four Critical Azure and Power Apps Vulns

Microsoft has fixed critical vulnerabilities in its core cloud services, including Azure Automation, Azure Storage, Azure DevOps, and Microsoft Power...
Read More
Microsoft Patches Four Critical Azure and Power Apps Vulns

Qilin Ransomware topped April 2025 with 45+ data leak disclosures

The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the...
Read More
Qilin Ransomware topped April 2025 with 45+ data leak disclosures

SonicWall Patches 3 Flaws in SMA 100 Devices

SonicWall has released patches for three security flaws in SMA 100 Secure Mobile Access appliances that could allow remote code...
Read More
SonicWall Patches 3 Flaws in SMA 100 Devices

Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

From April 2024 to April 2025, Flashpoint analysts noted that the financial sector was a major target for threat actors,...
Read More
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

Cisco has issued a security advisory for a critical vulnerability in its IOS XE Software for Wireless LAN Controllers (WLCs)....
Read More
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

These vulnerabilities pose serious risks for organizations using the tool for firewall migration and optimization. It is meant for temporary use only during migrations and not for production environments. The tool will reach its End of Life (EoL) on December 31, 2024.

Details Of The Vulnerabilities:

CVE-2025-0103 (CVSS 7.8): An SQL injection vulnerability lets authenticated attackers access Expedition’s database, exposing sensitive information such as password hashes and device configurations. It also allows them to create or read arbitrary files on the system.

CVE-2025-0104 (CVSS 4.7): A vulnerability that allows attackers to run harmful scripts in a user’s browser, which can lead to stealing information or hijacking sessions.

CVE-2025-0105 (CVSS 2.7): Allows unauthorized users to delete files accessible to the Expedition system’s “www-data” user.

CVE-2025-0106 (CVSS 2.7): A vulnerability allows attackers to list files on the system without needing to log in.

CVE-2025-0107 (CVSS 2.3): This vulnerability allows logged-in attackers to run any OS commands as the “www-data” user, potentially exposing sensitive firewall credentials.

These vulnerabilities don’t directly impact Palo Alto Networks firewalls, Panorama, Prisma Access, or Cloud NGFWs, but they severely weaken the security of systems using vulnerable Expedition versions.

Palo Alto Networks has released patches in Expedition version 1.2.101 and later. Organizations should upgrade immediately and change all credentials used with the tool.

Limiting network access to authorized users and disabling unused Expedition instances are essential to reduce risks.

Although there is currently no evidence of active exploitation, the existence of proof-of-concept exploits for similar vulnerabilities heightens concerns about possible future attacks. Organizations using Expedition must act quickly to protect their systems from unauthorized access.

Since Expedition has reached its end of life, users should switch to alternative tools recommended by Palo Alto Networks for firewall migration and policy optimization.

The discovery highlights the need to secure temporary tools like Expedition that manage sensitive data during important tasks, such as firewall migrations.

Check Also

Google

Google patched 2 Android zero-days and 60 other flaws

In its April 2025 security update, Google patched 62 vulnerabilities in Android, including two zero-days …

Leave a Reply

Your email address will not be published. Required fields are marked *