CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-0107: Expedition: OS Command Injection Vulnerability
7.7
CVSS
Description
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
Classification
CVE ID: CVE-2025-0107
CVSS Base Severity: HIGH
CVSS Base Score: 7.7
Affected Products
Vendor: Palo Alto Networks
Product: Cloud NGFW
Nuclei Template
http/cves/2025/CVE-2025-0107.yaml
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 12.0% (scored less or equal to compared to others)
EPSS Date: 2025-02-21 (when was this score calculated)