Tuesday, November 12, 2024
HomeCVE/vulnerabilityCISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

Published on

Malware protection

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability in Palo Alto Networks’ Expedition tool, which could lead to severe security breaches.

The vulnerability, CVE-2024-5910, is classified as a “Missing Authentication” flaw that potentially allows attackers with network access to take control of an Expedition admin account.

According to CISA’s alert, this could allow cybercriminals to access sensitive configuration data, including credentials and other highly privileged information.

- Advertisement - SIEM as a Service

Build an in-house SOC or outsource SOC-as-a-Service -> Calculate Costs

CVE-2024-5910 – Vulnerability Details

CVE-2024-5910 is linked to CWE-306 (Missing Authentication for Critical Function), a common weakness caused by an application not adequately verifying user credentials before granting access to sensitive functions.

In the case of Palo Alto Networks’ Expedition—a tool used for firewall migration and configuration analysis—the vulnerability could enable attackers to hijack the administrative interface and gain access to configuration secrets. 

While it is yet to be confirmed whether this vulnerability has been actively exploited in ransomware campaigns, CISA has urged all organizations using Palo Alto Expedition to take immediate action.

“The risk of this vulnerability being leveraged in targeted attacks is significant due to the high level of access it grants to attackers,” the advisory notes.

CISA has strongly advised organizations to apply the recommended mitigations outlined by Palo Alto Networks.

If mitigations are unavailable or impractical, CISA recommends discontinuing the product’s use to avoid potential compromise. The deadline for addressing this vulnerability is November 28, 2024.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

10 Best DNS Management Tools – 2025

Best DNS Management Tools play a crucial role in efficiently managing domain names and...

Sweet Security Announces Availability of its Cloud Native Detection & Response Platform on the AWS Marketplace

Customers can now easily integrate Sweet’s runtime detection and response platform into their AWS...

Researchers Detailed Credential Abuse Cycle

Cybercriminals exploit leaked credentials, obtained through various means, to compromise systems and data, enabling...

New Android Malware SpyAgent Taking Screenshots Of User’s Devices

SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Researchers Detailed Credential Abuse Cycle

Cybercriminals exploit leaked credentials, obtained through various means, to compromise systems and data, enabling...

New Android Malware SpyAgent Taking Screenshots Of User’s Devices

SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases...

Tor Network Suffers IP Spoofing Attack Via Non-Exit Relays

In late October 2024, a coordinated IP spoofing attack targeted the Tor network, prompting...