DaystoPatch

Palo Alto NetworksExploited incident

Expedition missing authentication allowing admin account takeover

CVE-2024-5910Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 7 Nov 2024

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
0h
First public report to first fixUnverified source
Follow-through
0h
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Unverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2024-5910 (advisory page)CuratedQuote not checked yet

    2024-07-10 Initial publication

    Coordinated disclosure with a fix; exploitation was reported by CISA in November 2024. Time from this timeline entry's data-date attribute (2024-07-10T16:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    CVE.org record CVE-2024-5910ClaimedQuote verified10 Jul 2024, 18:39 UTC

    Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:281f2be02248045c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet10 Jul 2024, 19:03 UTC

    Paloaltoの脆弱性情報 「CVE-2024-5910 Expedition: Missing Authentication Leads to Admin Account Takeover (Severity: CRITICAL)」が公開されました。

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-5910)ClaimedQuote verified7 Nov 2024

    Palo Alto Networks Expedition Missing Authentication Vulnerability

    Added to CISA's KEV catalog on 2024-11-07.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2024-5910 (advisory page)CuratedQuote not checked yet

    2024-07-10 Initial publication

    Time from this timeline entry's data-date attribute (2024-07-10T16:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    at disclosure

    Palo Alto Networks advisory CVE-2024-5910 (advisory page)CuratedQuote verified

    Ensure network access to Expedition is restricted to authorized users, hosts, or networks.

    The only later timeline entry (2024-11-07) updated the exploitation status, so the mitigation is taken to be in the initial advisory.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8b1b498c417e42e3…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    Palo Alto Networks advisory CVE-2024-5910 (advisory page)CuratedQuote verified

    This issue is fixed in Expedition 1.2.92 and all later versions.

    Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8b1b498c417e42e3…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    Palo Alto Networks advisory CVE-2024-5910 (advisory page)CuratedQuote verified

    This issue is fixed in Expedition 1.2.92 and all later versions.

    Single product line.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8b1b498c417e42e3…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. CVE-2024-5910

    Recorded in the revision history

    Expedition: Missing Authentication Leads to Admin Account Takeover

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 13 Jul 2024, 22:40 UTC: archived copyLater version captured 8 Nov 2024, 23:06 UTC: archived copyRecovered from archived copiesSnapshots 00b5b11e93… and bb23078dfd…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Palo Alto Networks Expedition (migration tool)
How we built this timeline

Timeline: 10 Jul 2024 initial publication; 7 Nov 2024 'Updated Exploitation Status section with report from CISA' (KEV 7 Nov 2024). Expedition is a migration tool that stores firewall credentials and was announced as end of life for 2025.

CVSS 9.3 (v4.0).

Related

Palo Alto Networks report card