A series of serious vulnerabilities have been identified in Palo Alto Networks’ Expedition migration tool, which could allow attackers to gain unauthorized access to sensitive data, including cleartext passwords and device configurations.
The vulnerabilities, detailed in multiple Common Vulnerabilities and Exposures (CVE) reports, highlight significant risks for organizations using this tool for transitioning to Palo Alto Networks’ next-generation firewall (NGFW) platform.
Overview of Expedition Tool
Expedition, formerly known as the Migration Tool, is a free utility designed solely for facilitating the migration of firewall configurations from other vendors to Palo Alto Networks’ systems.
It is not intended for production use and is meant to serve as a temporary workspace for security policy optimization.
Notably, Expedition reached its End of Life (EoL) on December 31, 2024, and users are encouraged to transition to alternative tools as outlined in the EoL announcement.
Details of Vulnerabilities
The identified vulnerabilities span several categories and severities, ranging from SQL injection to command injection.
These flaws could potentially compromise the confidentiality and integrity of data stored within the Expedition tool. Below is a summary of the critical vulnerabilities:
| CVE | CVSS Score | Summary |
| CVE-2025-0103 | 7.8 | SQL injection vulnerability allowing attackers to read database contents and create files. |
| CVE-2025-0104 | 4.7 | SQL injection vulnerability allows attackers to read database contents and create files. |
| CVE-2025-0105 | 2.7 | Arbitrary file deletion vulnerability accessible to unauthenticated attackers. |
| CVE-2025-0106 | 2.7 | Wildcard expansion vulnerability for file enumeration on the host filesystem. |
| CVE-2025-0107 | 2.3 | OS command injection allowing execution of arbitrary commands as the www-data user. |
While Palo Alto Networks has not reported any known exploitation of these vulnerabilities, the potential for data breaches or further attacks underscores the importance of addressing these issues promptly. Users of Expedition are strongly advised to:
- Update to the latest version: Ensure that you’re running Expedition version 1.2.101 or later to mitigate these vulnerabilities.
- Evaluate alternatives: Given the EoL status of Expedition, consider transitioning to other approved migration tools that align with your security needs.
- Monitor your systems: Regularly check logs and alerts for any unusual activities that may suggest an attempted exploitation of these vulnerabilities.
Organizations utilizing the Palo Alto Networks Expedition tool should take immediate steps to protect their data and maintain the integrity of their security policies.
By staying informed and proactive, users can help safeguard their systems against potential threats arising from these vulnerabilities.
ANY.RUN Threat Intelligence Lookup - Extract Millions of IOC's for Interactive Malware Analysis: Try for Free