CVE-2025-0107 is a critical (CVSS 9.8) OS command injection in Palo Alto Networks Expedition. An unauthenticated attacker can run commands as the www-data user, which can expose usernames, cleartext passwords, device configurations and firewall API keys. Versions below 1.2.101 are affected. Upgrade to 1.2.101, or retire the tool.
What's affected
The record names Palo Alto Networks Expedition, the free tool used to migrate firewall configurations to Palo Alto Networks next generation firewalls. Palo Alto Networks advisory PAN-SA-2025-0001, published 2025-01-08, says Expedition versions below 1.2.101 are affected and 1.2.101 and later are unaffected. The advisory states that no special configuration is needed to be affected.
Expedition reached end of life on December 31, 2024, and the advisory says no additional updates are planned or provided. The advisory also says Expedition is meant to be used only temporarily for migration and not to be run in production. It does not affect firewalls, Panorama appliances, Prisma Access or Cloud NGFWs.
The record says an unauthenticated attacker can run arbitrary operating system commands as the www-data user in Expedition. The record states that this results in disclosure of usernames, cleartext passwords, device configurations and device API keys for firewalls running PAN-OS software.
The same advisory covers CVE-2025-0103, CVE-2025-0104, CVE-2025-0105 and CVE-2025-0106. The advisory scores this issue lower than the NVD base score used in the title because it applies a different scoring method (CVSS 4.0 with threat and environment adjustments). We use the record's score here and recommend that you read the advisory for the vendor view. The advisory states that Palo Alto Networks is not aware of any malicious exploitation of these issues.
How to check if you're exposed
Find any Expedition servers, including ones set up for a past migration and forgotten.
- Search virtual machine inventories, cloud accounts and lab networks for hosts named after Expedition or the Migration Tool.
- Log in to the web interface and read the version. Anything below 1.2.101 is affected.
- Check who can reach the host. The advisory says no special configuration is needed, so reachability decides the risk.
- Look at what the host stores: uploaded firewall configurations, API keys and credentials.
If the tool is no longer needed, that is the simplest fix.
What to do now
- Find every Expedition installation and note the version.
- Upgrade to 1.2.101 or later if you must keep running it, and read the advisory on the end of life status.
- Prefer shutting down Expedition once the migration is finished.
- Restrict network access to the host to the people who need it.
- Rotate firewall API keys, credentials and passwords that were ever stored in or handled by Expedition.
- Review PAN-OS device credentials for any systems whose configuration passed through the tool.
Why it matters
That list is the real reason to act quickly. A migration tool collects the keys to the firewalls it helps move, so a break in the tool reaches past the tool itself. If the host held configuration from production firewalls, assume the data is valuable to an attacker.
The class is OS command injection: input reaches a shell command without being kept apart from the command text. The fix pattern is to avoid shell calls, pass arguments as a list and validate every value. Beyond patching, the best step is to remove temporary tools when the project ends, and to rotate credentials that passed through them.
The weakness class is CWE-78: OS Command Injection. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
What data is at risk?
The record names usernames, cleartext passwords, device configurations and firewall API keys.
Is it known to be exploited?
The advisory says Palo Alto Networks is not aware of malicious exploitation. The record is not in the CISA KEV catalog.
Sources
Last reviewed: 19 October 2026.
