Skip to content
Patcharo
Back to the results

Vulnerabilities

HighKEV

CVE-2024-3393 — PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

CVE-2024-3393 · PAN-OS · CVSS 7.5 · KEV

In brief

Severity · CVSS
High7.5CVSS 3.1, High
EPSS
28%
CISA KEV
Known exploited, listed since 30 Dec 2024
Products
PAN-OS
Published · Modified
·
Last verified

Summary

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Weakness: CWE-754

Title, description and the vendor's statements are quoted from the CVE record; a vendor's advisory is summarised in Patcharo's words, with a link.

Affected and fixed versions

Per product and release branch, as the vendor's CVE record and official advisory state them. A fixed release is shown only when a document names it: the vendor's, or CERT-FR's for Check Point, with its source.

4 branches with a published fixed release

Palo Alto Networks PAN-OS

Source: CVE-2024-3393

  1. 11.2Approaching end of support
    Affected versions>= 11.2.0, < 11.2.3
    First fixed release11.2.3
  2. 11.1Approaching end of support
    Affected versions>= 11.1.0, < 11.1.2-h16>= 11.1.3, < 11.1.3-h13>= 11.1.4, < 11.1.4-h7
    First fixed release11.1.2-h1611.1.3-h1311.1.4-h711.1.5
  3. 10.2End of life
    Affected versions>= 10.2.8, < 10.2.8-h19>= 10.2.9, < 10.2.9-h19>= 10.2.10, < 10.2.10-h12>= 10.2.11, < 10.2.11-h10>= 10.2.12, < 10.2.12-h4>= 10.2.13, < 10.2.13-h2>= 10.2.8, < 10.2.9-h19
    First fixed release10.2.9-h1910.2.10-h1210.2.11-h1010.2.12-h410.2.13-h210.2.14
  4. 10.1End of life
    Affected versions>= 10.1.14, < 10.1.14-h8
    First fixed release10.1.14-h810.1.15

Releases the vendor does not list are not affected.

Remediation

Fix available

Vendor fix

  • PAN-OS 11.211.2.3
  • PAN-OS 11.111.1.2-h16, 11.1.3-h13, 11.1.4-h7, 11.1.5
  • PAN-OS 10.210.2.9-h19, 10.2.10-h12, 10.2.11-h10, 10.2.12-h4, 10.2.13-h2, 10.2.14
  • PAN-OS 10.110.1.14-h8, 10.1.15

Upgrade to a fixed release listed above for your branch, or to a later fixed release the vendor explicitly supports.

This issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions. Note: PAN-OS 11.0 reached the end of life (EOL) on November 17, 2024, so we do not intend to provide a fix for this release.

Full text

Prisma Access customers using DNS Security with affected PAN-OS versions should apply one of the workarounds provided below. We will perform upgrades in two phases for impacted customers on the weekends of January 3rd and January 10th. You can request an expedited Prisma Access upgrade to the latest PAN-OS version by opening a support case https://support.paloaltonetworks.com/Support/Index . In addition, to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases. ​​Additional PAN-OS 11.1 fixes: * 11.1.2-h16 * 11.1.3-h13 * 11.1.4-h7 * 11.1.5 Addit…

SourcePalo Alto Networks (CVE record)

Mitigation (vendor)

If your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment.

Full text

Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama * For each Anti-spyware profile, navigate to Objects → Security Profiles → Anti-spyware → (select a profile) → DNS Policies → DNS Security. * Change the Log Severity to "none" for all configured DNS Security categories. * Commit the changes. Remember to revert the Log Severity settings once the fixes are applied. NGFW managed by Strata Cloud Manager (SCM) You can choose one of the following mitigation options: * Option 1: Disable DNS Security logging directly on each NGFW by following the PAN-OS steps above. * Option 2: Disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.pa…

SourcePalo Alto Networks (CVE record)

CISA KEV required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date:

SourceCISA KEV

CERT-FR recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).

SourceCERTFR-2024-AVI-1107

Last verified 1 Oct 2026 at 13:37 UTC

Known exploitation

Added to CISA KEV on 30 Dec 2024

Federal remediation due date: 20 Jan 2025

The CISA required action is shown under Remediation.

28% probability of exploitation in the next 30 days (percentile 98%).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CERT-FR

1 document of the French national CERT (ANSSI) references this CVE.

Advisory (AVI)CERTFR-2024-AVI-1107Published 27 Dec 2024

Vulnerability in Palo Alto Networks products

Remote denial of service

Summary

A vulnerability has been discovered in Palo Alto Networks products. It allows an attacker to cause a remote denial of service. Palo Alto Networks indicates that vulnerability CVE-2024-3393 is actively exploited.

Recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).

Official document on cert.ssi.gouv.frread by Patcharo 28 Sept 2026 at 20:04 UTCMachine translation of the French text published by CERT-FR; a text whose translation did not pass Patcharo's checks stays in French. Identifiers, versions and links are copied unchanged.

Timeline

  1. Published by the source
  2. Added to CISA KEV
  3. CISA remediation due date
  4. Source record last modified
  5. EPSS score computed
  6. Last verified by Patcharo

Official sources

Vendor advisory

References

Palo Alto Networks · CISA Known Exploited Vulnerabilities · NVD · FIRST EPSS

How Patcharo reads this

Affected and fixed releases come from the vendor's structured statements and are matched against exact versions; CVSS from NVD, exploitation from CISA KEV and the vendor's own advisory, probability from FIRST EPSS. Missing data stays Unknown and never becomes Not affected.

Read the methodologyRead the guide: PAN-OS versions explained: release lines, maintenance releases and the -h1, -h2, -h3 suffixes

Related vulnerabilities

Other records affecting the same products, newest first.

  • CVE-2026-0301PAN-OS: Information Disclosure Vulnerability in URL FilteringHigh
  • CVE-2026-0280PAN-OS: IPv6 Firewall Policy BypassHigh
  • CVE-2026-0281PAN-OS: Information Disclosure Vulnerability in Management Web InterfaceHigh
  • CVE-2026-0283PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)High
  • CVE-2026-0284PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)Critical

All PAN-OS vulnerabilitiesAll Palo Alto Networks vulnerabilities