Riskcovery

CVE-2024-9472

PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic

State
Published
Severity
8.7 High
Published
Nov 14, 2024
Updated
Nov 14, 2024
Reserved
Oct 3, 2024

Read the record on cve.org

Description

A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

Palo Alto Networks VM-Series, Cloud NGFW, and Prisma Access are not affected.

This issue only affects PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series running these specific versions of PAN-OS:

* 10.2.7-h12 * 10.2.8-h10 * 10.2.9-h9 * 10.2.9-h11 * 10.2.10-h2 * 10.2.10-h3 * 10.2.11 * 10.2.11-h1 * 10.2.11-h2 * 10.2.11-h3 * 11.1.2-h9 * 11.1.2-h12 * 11.1.3-h2 * 11.1.3-h4 * 11.1.3-h6 * 11.2.2 * 11.2.2-h1

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amberpalo_alto

Weaknesses

Affected Products

ProductVersions
Cloud NGFWPalo Alto Networks
  • AllNot affected
PAN-OSPalo Alto Networks
  • 11.2.2 to before 11.2.2-h3Affectedfrom 11.2.2-h3Not affectedfrom 11.2.3Not affected
  • 11.1.2-h9 to before 11.1.2-h14Affectedfrom 11.1.2-h14Not affectedfrom 11.1.3-h10Not affected
  • 11.0.0Not affected
  • 10.2.7-h12 to before 10.2.7-h16Affectedfrom 10.2.7-h16Not affectedfrom 10.2.8-h13Not affectedfrom 10.2.9-14Not affectedfrom 10.2.10-h7Not affectedfrom 10.2.11-h4Not affected
  • 10.1.0Not affected
Prisma AccessPalo Alto Networks
  • AllNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.