{"schema":"threatline.record/2","record":{"id":"CVE-2024-5910","aliases":[],"summary":"Palo Alto Networks Expedition Missing Authentication Vulnerability","details":"Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.","categories":["Unclassified"],"product":"Expedition","vendor":"Palo Alto Networks","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5910","source_modified_at":"2025-10-21T22:55:49.276Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Expedition","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"1.2.92","status":"unaffected"}],"lessThan":"1.2.92","status":"affected","version":"1.2","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5910","source_modified_at":"2025-10-21T22:55:49.276Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Expedition","ecosystem":null},"version":"1.2.92","basis":"first unaffected version stated in the CVE record"}],"cvss":9.3,"severity":"Critical","kev":{"listed":true,"date_added":"2024-11-07","due_date":"2024-11-28","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.91684,"percentile":0.99817,"score_date":"2026-10-23"},"published_at":"2024-07-10T18:39:26.006Z","modified_at":"2025-10-21T22:55:49.276Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-5910","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T22:55:49.276Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/paloalto_expedition_rce.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2024-10-09"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52129","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-04-06"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5910.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5910","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Exploit-DB","Nuclei","EPSS"],"references":[{"source":"CVE List","url":"https://security.paloaltonetworks.com/CVE-2024-5910","tags":["vendor-advisory","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5910","source":"CISA KEV"},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5910","tags":["government-resource"]},{"source":"CVE List","url":"https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2024-11-07T04:55:50.697197Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/paloalto_expedition_rce.rb","date":"2024-10-09","added":"2026-06-02","check":true},{"source":"Exploit-DB","kind":"Webapps exploit","name":"Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover","url":"https://www.exploit-db.com/exploits/52129","date":"2025-04-06","added":"2025-04-06","verified":false},{"source":"Nuclei","kind":"Scanner template","name":"Palo Alto Expedition - Admin Account Takeover","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5910.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2025-10-21T22:55:49.276Z","content_hash":"0d51e72039141a11205eb3ec8184e5f4c4ddd41d432d2d645a341489b8036885"}}