CVE-2024-3393

Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

Palo Alto Networks PAN-OSNetwork & edge

CVSS

8.7High

ExploitationExploited in the wildAdded to KEV 30 Dec 2024CISA KEV

Exploit odds (EPSS)29.1%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in11.2.3Also 11.1.2-h16, 10.2.8-h19 and 1 moreCVE List

Federal deadline20 Jan 2025Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

11.2.3PAN-OSCVE List
11.1.2-h16PAN-OSCVE List
10.2.8-h19PAN-OSCVE List
10.1.14-h8PAN-OSCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

27 Dec 2024, 09:44 UTCPublishedCVE List
30 Dec 2024Added to CISA KEVCISA KEV

Description

Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Text from CVE List

Affected versions 6

Cloud NGFWunaffected: AllCVE List
PAN-OSaffected: 11.2.0 before 11.2.3CVE List
PAN-OSaffected: 11.1.0 before 11.1.2-h16CVE List
PAN-OSaffected: 10.2.8 before 10.2.8-h19CVE List
PAN-OSaffected: 10.1.14 before 10.1.14-h8CVE List
PAN-OSunaffected: 10.2.0 before 10.2.8CVE List