CVE-2025-0107

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jan 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-01089.1An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the managementCVE-2025-01096.9An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attackerCVE-2025-01108.6A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the abilityCVE-2025-01116.5An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to CVE-2025-01126.8A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrCVE-2025-01135.3A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to DockerCVE-2025-01147.5A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attackCVE-2025-01156.8A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attCVE-2025-01166.8A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a sCVE-2025-01177.1A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticateCVE-2025-01188.0A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context oCVE-2025-01196.3A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS comma
CVE-2025-0107: Critical severity, CVSS 9.8 | Vulnix