HackZoneLabs News
Newsletter

CVE-2024-3393

PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

  • High 8.7
  • Exploited: added to CISA KEV 30 Dec 2024

Description

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Key facts

Published
27 Dec 2024
Last changed
21 Oct 2025
Assigned by
palo_alto
KEV added
30 Dec 2024
KEV fix due
20 Jan 2025
EPSS
30.218% likely to be exploited in the next 30 days, higher than 98.25% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: yes; Technical impact: partial

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 8.7CVSS 4.0, Highfrom the CNA (palo_alto)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber
  • 7.1CVSS 4.0, Highfrom the CNA (palo_alto)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber

What to do

  • If your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama * For each Anti-spyware profile, navigate to Objects → Security Profiles → Anti-spyware → (select a profile) → DNS Policies → DNS Security. * Change the Log Severity to "none" for all configured DNS Security categories. * Commit the changes. Remember to revert the Log Severity settings once the fixes are applied. NGFW managed by Strata Cloud Manager (SCM) You can choose one of the following mitigation options: * Option 1: Disable DNS Security logging directly on each NGFW by following the PAN-OS steps above. * Option 2: Disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index . Prisma Access managed by Strata Cloud Manager (SCM) Until we perform an upgrade of your Prisma Access tenant, you can disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index . If you would like to expedite the upgrade, please make a note of that in the support case.CNA workaround statement
  • Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-540 Overread Buffers (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
Palo Alto NetworksCloud NGFW
  • Default status: unaffected
  • All (unaffected)
Palo Alto NetworksPAN-OS
  • Default status: unaffected
  • 11.2.0 up to but excluding 11.2.3 (affected); at 11.2.3 unaffected
  • 11.1.0 up to but excluding 11.1.2-h16 (affected); at 11.1.2-h16 unaffected, at 11.1.3-h13 unaffected, at 11.1.4-h7 unaffected, at 11.1.5 unaffected
  • 10.2.8 up to but excluding 10.2.8-h19 (affected); at 10.2.8-h19 unaffected, at 10.2.9-h19 unaffected, at 10.2.10-h12 unaffected, at 10.2.11-h10 unaffected, at 10.2.12-h4 unaffected, at 10.2.13-h2 unaffected, at 10.2.14 unaffected
  • 10.1.14 up to but excluding 10.1.14-h8 (affected); at 10.1.14-h8 unaffected, at 10.1.15 unaffected
Palo Alto NetworksPAN-OS
  • Default status: unaffected
  • 10.2.0 up to but excluding 10.2.8 (unaffected); at 10.2.8 affected, at 10.2.9-h19 unaffected, at 10.2.10-h12 unaffected
  • 11.2.0 up to but excluding 11.2.3 (affected); at 11.2.3 unaffected

Timeline

  1. 27 Dec 2024 Initial publication
  2. 27 Dec 2024 Published
  3. 30 Dec 2024 CVE-2024-3393 added to CISA KEV
  4. 30 Dec 2024 Added to the CISA KEV catalogue

Weakness

References