Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Palo Alto PAN-OS may reboot from crafted DNS packets

CVE-2024-3393 · published 1 year ago · actively exploited
Summary

The PAN-OS operating system used in Palo Alto firewalls and Prisma Access can be tricked by specially formed DNS messages to restart the device. An unauthenticated attacker could cause repeated reboots, eventually putting the firewall into maintenance mode. Apply the latest security update from Palo Alto Networks as soon as possible to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
palo alto networks pan-os All versions
paloaltonetworks pan-os >= 11.1.0, <= 11.1.1
>= 11.2.0, < 11.2.3
10.1.14
10.2.8
10.2.9
10.2.10
10.2.11
10.2.12
10.2.13
11.1.2
11.1.3
11.1.4
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks prisma_access All versions
cpe:2.3:a:paloaltonetworks:prisma_access:-:*:*:*:*:*:*:*
Original advisory text
Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
References
Fix within
Internet-facing 3 days
Internal 14 days
  • Known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
29% chance of attack within 30 days
Type
CWE-754Improper Check for Unusual or Exceptional Conditions
Timeline
Published27 Dec 2024
Updated15 Oct 2026
First seen6 Mar 2026
Sources
CVE-2024-3393 · CISA KEV
CVE-2024-3393 · NVD
Track software like this
Free during beta