CVE-2024-3393: PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

Published Dec 27, 2024
·
Updated

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Other sources

Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

— CISA

Affected Software

87 affected componentsFixes available
Palo Alto Networks PAN-OS
Palo Alto Networks Cloud NGFW
Palo Alto Networks PAN-OS<11.2.3, =11.2.0, <11.1.5, =11.1.0
11.2.311.1.511.1.4-h711.1.2-h1611.1.3-h13
Palo Alto Networks PAN-OS>=11.1.0<=11.1.1
Palo Alto Networks PAN-OS>=11.2.0<11.2.3
Palo Alto Networks PAN-OS=10.1.14
Palo Alto Networks PAN-OS=10.1.14-h2
Palo Alto Networks PAN-OS=10.1.14-h4
Palo Alto Networks PAN-OS=10.1.14-h6
Palo Alto Networks PAN-OS=10.2.8
Palo Alto Networks PAN-OS=10.2.8-h10
Palo Alto Networks PAN-OS=10.2.8-h13
Palo Alto Networks PAN-OS=10.2.8-h15
Palo Alto Networks PAN-OS=10.2.8-h18
Palo Alto Networks PAN-OS=10.2.8-h3
Palo Alto Networks PAN-OS=10.2.8-h4
Palo Alto Networks PAN-OS=10.2.9
Palo Alto Networks PAN-OS=10.2.9-h1
Palo Alto Networks PAN-OS=10.2.9-h11
Palo Alto Networks PAN-OS=10.2.9-h14
Palo Alto Networks PAN-OS=10.2.9-h16
Palo Alto Networks PAN-OS=10.2.9-h18
Palo Alto Networks PAN-OS=10.2.9-h9
Palo Alto Networks PAN-OS=10.2.10
Palo Alto Networks PAN-OS=10.2.10-h10
Palo Alto Networks PAN-OS=10.2.10-h2
Palo Alto Networks PAN-OS=10.2.10-h3
Palo Alto Networks PAN-OS=10.2.10-h4
Palo Alto Networks PAN-OS=10.2.10-h5
Palo Alto Networks PAN-OS=10.2.10-h7
Palo Alto Networks PAN-OS=10.2.10-h9
Palo Alto Networks PAN-OS=10.2.11
Palo Alto Networks PAN-OS=10.2.11-h1
Palo Alto Networks PAN-OS=10.2.11-h2
Palo Alto Networks PAN-OS=10.2.11-h3
Palo Alto Networks PAN-OS=10.2.11-h4
Palo Alto Networks PAN-OS=10.2.11-h6
Palo Alto Networks PAN-OS=10.2.11-h9
Palo Alto Networks PAN-OS=10.2.12
Palo Alto Networks PAN-OS=10.2.12-h1
Palo Alto Networks PAN-OS=10.2.12-h2
Palo Alto Networks PAN-OS=10.2.12-h3
Palo Alto Networks PAN-OS=10.2.13
Palo Alto Networks PAN-OS=10.2.13-h1
Palo Alto Networks PAN-OS=11.1.2
Palo Alto Networks PAN-OS=11.1.2-h1
Palo Alto Networks PAN-OS=11.1.2-h12
Palo Alto Networks PAN-OS=11.1.2-h14
Palo Alto Networks PAN-OS=11.1.2-h15
Palo Alto Networks PAN-OS=11.1.2-h3
Palo Alto Networks PAN-OS=11.1.2-h4
Palo Alto Networks PAN-OS=11.1.2-h9
Palo Alto Networks PAN-OS=11.1.3
Palo Alto Networks PAN-OS=11.1.3-h1
Palo Alto Networks PAN-OS=11.1.3-h10
Palo Alto Networks PAN-OS=11.1.3-h11
Palo Alto Networks PAN-OS=11.1.3-h2
Palo Alto Networks PAN-OS=11.1.3-h4
Palo Alto Networks PAN-OS=11.1.3-h6
Palo Alto Networks PAN-OS=11.1.4
Palo Alto Networks PAN-OS=11.1.4-h1
Palo Alto Networks PAN-OS=11.1.4-h4
All of the following
Palo Alto Networks Prisma Access
Any of the following
Palo Alto Networks PAN-OS>=10.2.11<11.2.3
Palo Alto Networks PAN-OS=10.2.8
Palo Alto Networks PAN-OS=10.2.8-h10
Palo Alto Networks PAN-OS=10.2.8-h13
Palo Alto Networks PAN-OS=10.2.8-h15
Palo Alto Networks PAN-OS=10.2.8-h18
Palo Alto Networks PAN-OS=10.2.8-h19
Palo Alto Networks PAN-OS=10.2.8-h3
Palo Alto Networks PAN-OS=10.2.8-h4
Palo Alto Networks PAN-OS=10.2.9
Palo Alto Networks PAN-OS=10.2.9-h1
Palo Alto Networks PAN-OS=10.2.9-h11
Palo Alto Networks PAN-OS=10.2.9-h14
Palo Alto Networks PAN-OS=10.2.9-h16
Palo Alto Networks PAN-OS=10.2.9-h18
Palo Alto Networks PAN-OS=10.2.9-h9
Palo Alto Networks PAN-OS=10.2.10
Palo Alto Networks PAN-OS=10.2.10-h10
Palo Alto Networks PAN-OS=10.2.10-h2
Palo Alto Networks PAN-OS=10.2.10-h3
Palo Alto Networks PAN-OS=10.2.10-h4
Palo Alto Networks PAN-OS=10.2.10-h5
Palo Alto Networks PAN-OS=10.2.10-h7
Palo Alto Networks PAN-OS=10.2.10-h9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.3Fixed in 11.1.5Fixed in 11.1.4-h7Fixed in 11.1.2-h16Fixed in 11.1.3-h13
  2. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.1.14-h8
  3. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.1.15
  4. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.10-h12
  5. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.11-h10
  6. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.12-h4
  7. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.13-h2
  8. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.14
  9. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.8-h19
  10. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.9-h19
  11. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.2-h16
  12. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.3-h13
  13. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.4-h7
  14. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.5
  15. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.3
  16. Configuration

    For each custom Anti-Spyware profile: Objects → Security Profiles → Anti-Spyware → (select profile) → DNS Policies → DNS Security — change Log Severity to 'none' for all configured DNS Security categories; commit the changes.

    Anti-Spyware -> DNS Security Log Severity = none
  17. Configuration

    If using predefined Anti-Spyware profiles (Default or Strict), clone each relevant predefined Anti-Spyware profile to create a custom profile, then replace the predefined profile in your Security Rules (Policies → Security → (security rule) → Actions → Profiles or Actions → Group) with the cloned custom Anti-Spyware profile or group.

    Anti-Spyware profile profile usage in Security Rules = use cloned custom profile
  18. Compensating control

    Disable DNS Security logging across all NGFWs in your tenant by opening a support case with Palo Alto Networks to request tenant-wide disabling of DNS Security logging until fixes can be applied.

  19. Operational

    Ensure that a DNS Security Configuration is present in the device configuration before changing Log Severity settings.

  20. Operational

    Commit the configuration changes after adjusting Anti-Spyware/DNS Security settings.

  21. Operational

    After applying the PAN-OS fixes (for example one of: 10.1.15, 10.2.14, 11.1.5, 11.2.3 or later), revert the Log Severity settings from 'none' back to their prior values.

Event History

Dec 27, 2024
Advisory Published
via Palo Alto Networks·02:30 AM
Known Exploited
via Palo Alto Networks·02:30 AM
CVE Published
via MITRE·09:44 AM
Data Sourced
via MITRE·09:44 AM
DescriptionWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeaknessAffected Software
News Published
via BleepingComputer·04:33 PM
News Published
via BleepingComputer·04:35 PM
Jan 6, 2025
News Published
via The Register·01:24 AM
News Published
via The Register·01:27 AM
Jan 30, 2025
Advisory Published
via Palo Alto Networks·12:00 AM
Jan 15, 2026
News Published
via BleepingComputer·09:02 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-3393?

CVE-2024-3393 has a high severity because it allows an unauthenticated attacker to remotely reboot the affected firewall due to a Denial of Service vulnerability.

2

How do I fix CVE-2024-3393?

To fix CVE-2024-3393, you should upgrade your Palo Alto Networks PAN-OS to a version that addresses this vulnerability, specifically versions 11.2.3, 11.1.5, 11.1.4-h6, 11.1.2-h16, or 11.1.3-h13.

3

What types of Palo Alto Networks products are affected by CVE-2024-3393?

CVE-2024-3393 affects the Palo Alto Networks PAN-OS and Cloud NGFW products.

4

What happens if CVE-2024-3393 is exploited?

If exploited, CVE-2024-3393 allows attackers to send a malicious packet that causes the affected firewall to reboot, resulting in a Denial of Service.

5

Is there a work-around for CVE-2024-3393?

Currently, there is no known work-around for CVE-2024-3393, so upgrading the affected software is the recommended action.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2024-3393 - PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet - SecAlerts