CVE-2024-3393highunder attackCWE-754

CVE-2024-3393: high-severity vulnerability in Palo Alto Networks PAN-OS

PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

Published · Updated

76Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.7epss 29%
from disclosure to weapon13 days
Published on NVDDec 27
1st PoC+13d
CISA KEV+3d
exploitation probability
29%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
Action required by CISAfederal deadline: 2025-01-20

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Palo Alto Networks PAN-OS DNS Security feature allows an attacker to crash the firewall by sending a specially crafted packet, causing it to reboot repeatedly until it stops working.

Technical detail

An unauthenticated attacker can exploit a denial of service vulnerability in the PAN-OS DNS Security feature by sending a malicious packet through the firewall's data plane, triggering an uncontrolled reboot condition. Repeated exploitation forces the device into maintenance mode, rendering it unavailable.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber
Affected products
Palo Alto Networks · Cloud NGFWPalo Alto Networks · PAN-OS
public PoCs found — 1
vulncheckvulncheck.com/xdb/07151b94c337unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Palo Alto Networks PAN-OS

In the same product, most dangerous first.

CVE-2024-3400CRITICALPAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectEPSS 100.0%KEVCVE-2024-0012CRITICALPAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)EPSS 99.9%KEVCVE-2025-0108HIGHPAN-OS: Authentication Bypass in the Management Web InterfaceEPSS 98.5%KEVCVE-2026-0257HIGHPAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesEPSS 96.9%KEVCVE-2024-9474MEDIUMPAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfaceEPSS 94.8%KEVCVE-2026-0300CRITICALPAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication PortalEPSS 31.7%KEV
References
https://security.paloaltonetworks.com/CVE-2024-3393https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3393