Cloud NGFW - RCE (CVE-2025-0107)

CVE-2025-0107, a vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to execute arbitrary OS commands as the www-data user in Expedition. This can lead to the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

CrowdSec has been tracking this vulnerability and its exploits since 17th of June 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-0107 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-0107 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-0107 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the Palo Alto command injection by sending GET requests to the /API/regionsDiscovery.php endpoint to achieve remote code execution.