Actively exploited · Published Dec 27, 2024 · Assigned by palo_alto

CVE-2024-3393PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

High 8.7 Exploited

In plain English

A high-severity security flaw in Cloud NGFW from Palo Alto Networks. Attackers are actively exploiting it in the wild (listed by CISA on December 30, 2024). The chance it is exploited in the next 30 days is estimated at 29.1% (higher than 98% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)29.1%top 1.8% of all CVEs

Exploited in the wildYesCISA KEV since Dec 30, 2024

Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Jan 20, 2025.

Official description

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	Cloud NGFW	see references
Palo Alto Networks	PAN-OS	11.2.0 – before 11.2.311.1.0 – before 11.1.2-h1610.2.8 – before 10.2.8-h1910.1.14 – before 10.1.14-h8
Palo Alto Networks	PAN-OS	11.2.0 – before 11.2.3

Weakness: CWE-754 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber

References

https://security.paloaltonetworks.com/CVE-2024-3393 vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3393 government-resource