CVE-2024-3393 Palo Alto Networks PAN-OS Malicious DNS Packet
An unauthenticated attacker can reboot a Palo Alto Networks firewall by sending a malicious packet, causing a denial of service.
- Exploited in the wild
- Since 30 Dec 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3393?
CVE-2024-3393 is a high-severity denial of service vulnerability in Paloaltonetworks Pan-Os, published on 27 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Weakness: CWE-754
Which versions are affected by CVE-2024-3393?
It affects 2 products.
Products include Paloaltonetworks Pan-Os, Paloaltonetworks Prisma Access.
How do I fix CVE-2024-3393?
No fix has been published for CVE-2024-3393 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 20 Jan 2025.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-3393 being exploited?
Yes. Attackers have exploited CVE-2024-3393 in the wild since at least 30 Dec 2024.
Other vulnerabilities in Paloaltonetworks Pan-Os
- CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection
- CVE-2020-2021 Palo Alto Networks PAN-OS Authentication Bypass
- CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code Execution
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write
- CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass
Sources
Also known as GHSA-gm94-vr86-wgqv.