Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability (CVE-2024-3393)
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
A remote attacker, without authentication, can achieve partial data exposure, complete denial of service or system unavailability. Federal agencies are required to remediate by 2025-01-20 under CISA BOD 22-01.
This is a Software Vulnerability (CWE-754) (CWE-754) vulnerability in Palo Alto Networks PAN-OS. A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2024-12-30 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2025-01-20.
Manual remediation steps
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.