Intrusion PreventionPalo.Alto.Networks.Expedition.Admin.Password.Reset
Description
This indicates an attack attempt to exploit an Authentication Bypass vulnerability in Palo Alto Networks Expedition.
The vulnerability is due to improper handling of user-supplied inputs. A remote, unauthenticated attacker can exploit the vulnerability by sending a crafted Admin password reset request to the vulnerable device. Successfully exploiting the vulnerability could allow an attacker to login using the default password.
Outbreak Alert
FortiGuard sensors continue to detect and block attack attempts targeting the Palo Alto Expedition vulnerabilities that could allow attackers to take over administrative accounts, putting configuration secrets, credentials, and other imported data within Expedition at serious risk.
Affected Products
Palo Alto Networks Expedition versions before 1.2.96
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://security.paloaltonetworks.com/PAN-SA-2024-0010
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| ID | 56726 |
| Created | Oct 10, 2024 |
| Updated | Oct 25, 2024 |
| CVE ID | |
| Tags | Palo Alto Expedition Vulnerability Threat Signal |
| Risk |
|
| Known Exploited | Yes |
| Exploit Prediction Score | 91.03% |
| Default Action | drop |
| Active | |
| Affected OS | Linux |
| Affected App | Other |
| Profile Type | Permission/Privilege/Access Control |