ZeroDay Findings
Sign inSign up

Findings

CVE-2024-3393

Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

Published Dec 27, 2024 · updated Jun 17, 2026 · paloaltonetworks pan-os

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 27, 2024 · Catalog

    Detected

    A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

  2. Dec 30, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Jan 20, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Jan 20, 2025

Affected

  • cpe paloaltonetworks/pan-osversion unspecified
  • cpe paloaltonetworks/pan-os10.1.14
  • cpe paloaltonetworks/pan-os10.2.8
  • cpe paloaltonetworks/prisma accessversion unspecified
  • vendor Palo Alto Networks PAN-OSversion unspecified

Sources

  • CISA KEVCVE-2024-3393

    Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

    cisa.gov
  • CVE.orgCVE-2024-3393

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-3393

    30-day exploitation probability 29.1%

    first.org
  • NIST NVDCVE-2024-3393

    A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cau

    nvd.nist.gov

References