U.S. Agency CISA Alerts: Federal Systems Are at Risk Due to Palo Alto Networks Vulnerability

A serious security vulnerability in Palo Alto Networks' Expedition tool has prompted an urgent warning from the Cybersecurity and Infrastructure Security Agency (CISA). Both private and federal networks are at significant danger from this vulnerability, which has been used in recent attacks to get unauthorized access to private data on servers that are vulnerable.

Cyber Crime Nov 8, 2024 0 12 Add to Reading List

U.S. Agency CISA Alerts: Federal Systems Are at Risk Due to Palo Alto Networks Vulnerability

A critical vulnerability in Palo Alto Networks' Expedition, a popular tool that helps businesses migrate firewall configurations from other vendors, like Checkpoint and Cisco, to Palo Alto's PAN-OS system, was the subject of a high-priority alert from the Cybersecurity and Infrastructure Security Agency (CISA) today. Officially known as CVE-2024-5910, this vulnerability only impacts Expedition versions that were fixed in July; unpatched versions are still vulnerable to cyberattacks.

Attackers can remotely reset administrative credentials on servers where Expedition can be accessed online thanks to the vulnerability. Attackers can obtain unauthorized access to the Expedition tool and perhaps take control of configuration data, sensitive credentials, and other stored information by taking advantage of this missing authentication check.

According to CISA's warning, researcher Zach Hanley of Horizon3.ai recently showed how this weakness may be coupled with CVE-2024-9464, a command injection issue that was fixed last month. Chaining these vulnerabilities would enable attackers to penetrate networks and change firewall settings by enabling them to run arbitrary commands on susceptible Expedition servers without authentication.

In light of a directive from November 2021 (BOD 22-01), which requires U.S. federal agencies to protect their susceptible Expedition servers from potential attacks by November 28, CISA has now listed this vulnerability to its Known Exploited Vulnerabilities Catalog. The high-risk nature of these vulnerabilities—which frequently operate as entry gates for malevolent cyber actions aimed at vital systems—is reflected in their urgency.

Additionally, Palo Alto Networks has released advisories advising all customers to change their usernames, passwords, and API keys linked to the PAN-OS firewalls and Expedition tool after any changes. The cybersecurity organization suggests limiting network access to the Expedition servers in order to reduce risks for people who are unable to apply security upgrades right once.

The CISA advisory highlights the persistent risks associated with missing or insufficient authentication features in popular cybersecurity products, and it calls on businesses to take immediate action to protect their networks from possible abuse of this weakness.