How severe is CVE-2024-3393?

CVE-2024-3393 has a CVSS 4.0 base score of 8.7 (HIGH). EPSS estimates a 28.6% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2024-3393: PAN-OS: Firewall Denial of Service (DoS) in DNS

CISA Known Exploited Vulnerabilities

Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2024-12-30

Remediation due

2025-01-20

Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA notes
https://security.paloaltonetworks.com/CVE-2024-3393 ; https://nvd.nist.gov/vuln/detail/CVE-2024-3393

Description

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Severity

CVSS 4.0 · CNA8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber

CVSS 4.0 · CNA7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impactpartial

Affected Products

Vendor	Product	Affected versions
Palo Alto Networks	Cloud NGFW	All (unaffected)
Palo Alto Networks	PAN-OS	11.2.0 to <11.2.3 (fixed ≥ 11.2.3) 11.1.0 to <11.1.2-h16 (fixed ≥ 11.1.2-h16, 11.1.3-h13, 11.1.4-h7, 11.1.5) 10.2.8 to <10.2.8-h19 (fixed ≥ 10.2.8-h19, 10.2.9-h19, 10.2.10-h12, 10.2.11-h10, 10.2.12-h4, 10.2.13-h2, 10.2.14) 10.1.14 to <10.1.14-h8 (fixed ≥ 10.1.14-h8, 10.1.15)
Palo Alto Networks	PAN-OS	10.2.0 to <10.2.8 (unaffected; fixed ≥ 10.2.9-h19, 10.2.10-h12; affected again ≥ 10.2.8) 11.2.0 to <11.2.3 (fixed ≥ 11.2.3)

References

1 Links

Vendor advisories

https://security.paloaltonetworks.com/CVE-2024-3393

Record Details

Published

2024-12-27

Last updated

2025-10-21

Assigner (CNA)

palo_alto

Credited to

Palo Alto Networks thanks the CERT-EE team for their extra effort in providing invaluable forensic and analytic assistance.

More from Palo Alto Networks

CVE-2024-340010

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

CVE-2024-00129.3

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

CVE-2024-94659.2

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

CVE-2024-94639.9

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-754 · Improper Check for Unusual or Exceptional Conditions

Application Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.