Palo Alto Networks Security Advisories / CVE-2018-10143

CVE-2018-10143 Remote Code Execution in Expedition Migration Tool

Severity 9.8 · CRITICAL
Attack Vector NETWORK
Attack Complexity LOW
Confidentiality Impact HIGH
Privileges Required NONE
Integrity Impact HIGH
User Interaction NONE
Availability Impact HIGH


A remote code execution vulnerability exists in the Palo Alto Networks Migration Tool (“Expedition”). (Ref # MT-794/ CVE-2018-10143)

Successful exploitation of this issue may allow an unauthenticated attacker with remote access to run system level commands on the device hosting this service/application.

This issue affects Expedition 1.0.107 and earlier.

Note that this issue only impacts the Palo Alto Networks Migration Tool (“Expedition”), a tool available from the Palo Alto Networks Live site. This issue does not affect PAN-OS or any other supported product or service. For more information on Expedition, see:

Product Status

Expedition 1.0<= 1.0.107>= 1.0.108

Severity: CRITICAL

CVSSv3.1 Base Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness Type

CWE-269 Improper Privilege Management


Expedition 1.0.108 and later

Workarounds and Mitigations



Palo Alto Networks would like to thank Reginald Dodd for reporting this issue.
© 2024 Palo Alto Networks, Inc. All rights reserved.