Riskcovery

CVE-2024-3393

PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

State
Published
Severity
8.7 High
Published
Dec 27, 2024
Updated
Oct 21, 2025
Reserved
Apr 5, 2024

Read the record on cve.org

Description

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amberpalo_alto
4.07.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amberpalo_alto

Weaknesses

  • CWE-754 Improper Check for Unusual or Exceptional Conditions

Affected Products

ProductVersions
Cloud NGFWPalo Alto Networks
  • AllNot affected
PAN-OSPalo Alto Networks
  • 11.2.0 to before 11.2.3Affectedfrom 11.2.3Not affected
  • 11.1.0 to before 11.1.2-h16Affectedfrom 11.1.2-h16Not affectedfrom 11.1.3-h13Not affectedfrom 11.1.4-h7Not affectedfrom 11.1.5Not affected
  • 10.2.8 to before 10.2.8-h19Affectedfrom 10.2.8-h19Not affectedfrom 10.2.9-h19Not affectedfrom 10.2.10-h12Not affectedfrom 10.2.11-h10Not affectedfrom 10.2.12-h4Not affectedfrom 10.2.13-h2Not affectedfrom 10.2.14Not affected
  • 10.1.14 to before 10.1.14-h8Affectedfrom 10.1.14-h8Not affectedfrom 10.1.15Not affected
PAN-OSPalo Alto Networks
  • 10.2.0 to before 10.2.8Not affectedfrom 10.2.8Affectedfrom 10.2.9-h19Not affectedfrom 10.2.10-h12Not affected
  • 11.2.0 to before 11.2.3Affectedfrom 11.2.3Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.