CVE-2024-9468: PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet (Severity: HIGH)

Published Oct 9, 2024

Updated

A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

Affected Software

68 affected componentsFixes available

Palo Alto Networks Cloud NGFW

Palo Alto Networks PAN-OS<11.1.3, =11.1.0, <11.0.4-h5, =11.0.0, <10.2.4-h24, =10.2.0

11.1.311.0.4-h511.0.610.2.9-h1110.2.10-h410.2.1110.2.8-h2010.2.7-h2410.2.4-h24

Palo Alto Networks Prisma Access

Palo Alto Networks PAN-OS>=10.2.0<10.2.4

Palo Alto Networks PAN-OS>=10.2.5<10.2.7

Palo Alto Networks PAN-OS>=11.0.0<11.0.4

Palo Alto Networks PAN-OS>=11.0.5<11.0.6

Palo Alto Networks PAN-OS>=11.1.0<11.1.3

Palo Alto Networks PAN-OS=10.2.4

Palo Alto Networks PAN-OS=10.2.4-h10

Palo Alto Networks PAN-OS=10.2.4-h16

Palo Alto Networks PAN-OS=10.2.4-h2

Palo Alto Networks PAN-OS=10.2.4-h3

Palo Alto Networks PAN-OS=10.2.4-h4

Palo Alto Networks PAN-OS=10.2.7

Palo Alto Networks PAN-OS=10.2.7-h1

Palo Alto Networks PAN-OS=10.2.7-h10

Palo Alto Networks PAN-OS=10.2.7-h11

Palo Alto Networks PAN-OS=10.2.7-h12

Palo Alto Networks PAN-OS=10.2.7-h13

Palo Alto Networks PAN-OS=10.2.7-h14

Palo Alto Networks PAN-OS=10.2.7-h15

Palo Alto Networks PAN-OS=10.2.7-h16

Palo Alto Networks PAN-OS=10.2.7-h17

Palo Alto Networks PAN-OS=10.2.7-h18

Palo Alto Networks PAN-OS=10.2.7-h19

Palo Alto Networks PAN-OS=10.2.7-h2

Palo Alto Networks PAN-OS=10.2.7-h20

Palo Alto Networks PAN-OS=10.2.7-h21

Palo Alto Networks PAN-OS=10.2.7-h22

Palo Alto Networks PAN-OS=10.2.7-h23

Palo Alto Networks PAN-OS=10.2.8

Palo Alto Networks PAN-OS=10.2.8-h1

Palo Alto Networks PAN-OS=10.2.8-h10

Palo Alto Networks PAN-OS=10.2.8-h11

Palo Alto Networks PAN-OS=10.2.8-h12

Palo Alto Networks PAN-OS=10.2.8-h13

Palo Alto Networks PAN-OS=10.2.8-h14

Palo Alto Networks PAN-OS=10.2.8-h15

Palo Alto Networks PAN-OS=10.2.8-h16

Palo Alto Networks PAN-OS=10.2.8-h17

Palo Alto Networks PAN-OS=10.2.8-h18

Palo Alto Networks PAN-OS=10.2.8-h19

Palo Alto Networks PAN-OS=10.2.8-h2

Palo Alto Networks PAN-OS=10.2.8-h3

Palo Alto Networks PAN-OS=10.2.8-h4

Palo Alto Networks PAN-OS=10.2.8-h5

Palo Alto Networks PAN-OS=10.2.8-h6

Palo Alto Networks PAN-OS=10.2.8-h7

Palo Alto Networks PAN-OS=10.2.8-h8

Palo Alto Networks PAN-OS=10.2.8-h9

Palo Alto Networks PAN-OS=10.2.9

Palo Alto Networks PAN-OS=10.2.9-h1

Palo Alto Networks PAN-OS=10.2.9-h2

Palo Alto Networks PAN-OS=10.2.9-h3

Palo Alto Networks PAN-OS=10.2.9-h4

Palo Alto Networks PAN-OS=10.2.9-h5

Palo Alto Networks PAN-OS=10.2.9-h6

Palo Alto Networks PAN-OS=10.2.9-h7

Palo Alto Networks PAN-OS=10.2.9-h8

Palo Alto Networks PAN-OS=10.2.9-h9

Palo Alto Networks PAN-OS=10.2.10

Palo Alto Networks PAN-OS=10.2.10-h1

Palo Alto Networks PAN-OS=10.2.10-h2

Palo Alto Networks PAN-OS=10.2.10-h3

Palo Alto Networks PAN-OS=11.0.4

Palo Alto Networks PAN-OS=11.0.4-h1

Palo Alto Networks PAN-OS=11.0.4-h2

Remediation

Information

This issue is fixed in 10.2.9-h11, 10.2.10-h4, PAN-OS 10.2.11, PAN-OS 11.0.4-h5, PAN-OS 11.0.6, PAN-OS 11.1.3, and all later PAN-OS versions.

Mitigation

Customers can block attacks for this vulnerability by disabling this setting: Device > Setup Session > Decryption Settings > SSL Decryption Settings > Send handshake messages to CTD for inspection. Customers with a Threat Prevention subscription, who want to keep domain fronting detection enabled, can block attacks for this vulnerability by enabling Threat ID 94971 (introduced in Applications and Threats content version 8854).

Event History

Oct 9, 2024

Advisory Published

via Palo Alto Networks·04:00 PM

CVE Published

via MITRE·05:05 PM

Data Sourced

via MITRE·05:05 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Apr 30, 2025

Advisory Published

via Palo Alto Networks·05:45 PM

Frequently Asked Questions

What is the severity of CVE-2024-9468?

CVE-2024-9468 is categorized as a denial of service (DoS) vulnerability due to memory corruption in Palo Alto Networks PAN-OS.

How do I fix CVE-2024-9468?

To mitigate CVE-2024-9468, upgrade to the latest patched version of PAN-OS recommended by Palo Alto Networks.

Who is affected by CVE-2024-9468?

CVE-2024-9468 affects users of Palo Alto Networks PAN-OS versions up to 10.2.9-h11, 11.0.4-h5, and specific versions of Cloud NGFW and Prisma Access.

What is the impact of CVE-2024-9468?

Exploitation of CVE-2024-9468 can lead to an attacker being able to crash PAN-OS, causing a denial of service condition.

Is CVE-2024-9468 remotely exploitable?

Yes, CVE-2024-9468 can be exploited remotely by an unauthenticated attacker.