CVE-2024-3393
Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
Description
CVE-2024-3393 is a high-severity Denial of Service (DoS) vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software used across their next-generation firewalls. An unauthenticated attacker can send a specially crafted malicious packet through the data plane of the firewall, causing it to reboot, and repeated exploitation forces the device into maintenance mode, effectively disabling network protection. With a CVSS v3.1 base score of 7.5 and an EPSS score of 78.02% at the 99th percentile, this vulnerability ranks among the most actively exploited firewall flaws. CISA has added CVE-2024-3393 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 20, 2025, underscoring the urgency of patching affected PAN-OS deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | >= 11.1.0, <= 11.1.1; >= 11.2.0, < 11.2.3; 10.1.14; 10.2.8; 10.2.9; 10.2.10; 10.2.11; 10.2.12; 10.2.13; 11.1.2; 11.1.3; 11.1.4 |
| paloaltonetworks | prisma access | - |
References
- https://security.paloaltonetworks.com/CVE-2024-3393(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3393(US Government Resource)
Weakness Type
Denial of Service via DNS Security Feature
CVE-2024-3393 involves a flaw in the DNS Security processing pipeline within PAN-OS. The vulnerability is triggered when the firewall's DNS Security feature processes a specially crafted DNS packet, causing improper handling that leads to a system crash and reboot. While no specific CWE has been formally assigned by the vendor, the behavior aligns with improper input validation in network packet processing. The DNS Security feature is designed to inspect and block malicious DNS traffic, but a malformed packet exploiting this flaw bypasses the validation logic and destabilizes the firewall's data plane, resulting in a complete device reboot. When repeatedly triggered, the firewall enters maintenance mode, a degraded state that removes all security inspection capabilities until manual administrative intervention restores normal operation.
Impact Analysis
The impact of CVE-2024-3393 is concentrated entirely on availability, which receives a high rating in the CVSS vector. While confidentiality and integrity remain unaffected (both rated None), the availability impact is severe because a single unauthenticated packet can take an entire enterprise firewall offline. In production environments where PAN-OS firewalls serve as the primary network security perimeter, a successful exploit creates a complete gap in security monitoring and enforcement.
The business consequences extend well beyond the immediate reboot. Each restart cycle takes several minutes, during which the network is either unprotected or traffic is blocked entirely, depending on the failover configuration. Repeated exploitation forcing maintenance mode is particularly damaging because it requires manual administrator intervention to restore the firewall to operational status, potentially leaving organizations without perimeter security for extended periods. The attack requires no authentication (PR:N), no user interaction (UI:N), and operates over the network with low complexity (AC:L), meaning any attacker who can send DNS traffic through the firewall can trigger the vulnerability. The EPSS score of 78.02% at the 99th percentile confirms that this vulnerability is under widespread active exploitation, and while CISA lists the ransomware association as unknown, the ability to disable security infrastructure is a common precursor technique used by ransomware operators to facilitate lateral movement.
Exploit Maturity
CVE-2024-3393 exhibits extremely high exploit maturity. CISA has confirmed active exploitation by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of January 20, 2025. The EPSS score of 78.02% places it at the 99th percentile, indicating it is among the most likely vulnerabilities to be exploited across the entire CVE database.
The Palo Alto Networks security advisory provides detailed information about the vulnerability and confirms that exploitation has been observed in production environments. The low barrier to exploitation is a critical factor in its widespread abuse: the attack requires only the ability to send a crafted DNS packet through the firewall's data plane, which is the normal path for all network traffic. No authentication, special access, or complex attack chain is needed. The vulnerability is particularly attractive to attackers because disabling a firewall creates immediate tactical advantages, whether as a standalone denial-of-service attack or as preparation for further network intrusion. While the ransomware connection remains unconfirmed, the pattern of targeting network security infrastructure aligns with tactics commonly employed by advanced threat groups and ransomware operators seeking to disable defensive controls before deploying payloads.
Remediation
-
Apply PAN-OS patches immediately. Upgrade affected firewalls to PAN-OS 10.1.14-h8, 10.2.10-h12, 11.1.5, 11.2.3, or later versions as specified in the Palo Alto Networks advisory. Prioritize internet-facing firewalls that process external DNS traffic.
-
Implement temporary mitigation if immediate patching is not possible. Palo Alto Networks recommends disabling DNS Security logging or modifying the DNS Security profile configuration to reduce the attack surface until patches can be applied. Follow the vendor advisory for specific configuration steps appropriate to your PAN-OS version.
-
Verify firewall recovery procedures. Ensure that your operations team knows how to recover a firewall from maintenance mode, as repeated exploitation will force devices into this state. Document the recovery steps and test failover configurations to minimize downtime during an active attack.
-
Monitor for exploitation attempts. Review firewall logs for unexpected reboots, repeated crash events, or maintenance mode transitions that could indicate active exploitation. Configure alerting for system stability events across all PAN-OS devices in your environment.
-
Assess network resilience during firewall outages. Evaluate whether your network architecture provides adequate security coverage if a firewall goes offline. Consider deploying redundant firewalls in high-availability configurations and verify that failover mechanisms function correctly to maintain protection during an attack.
Technical Details
CVE-2024-3393 is a Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a network-accessible attack with low complexity, no privilege or user interaction requirements, and high availability impact with no effect on confidentiality or integrity.
The vulnerability resides in the data plane processing logic of the DNS Security feature. When DNS Security is enabled, PAN-OS inspects DNS queries and responses passing through the firewall to detect and block connections to malicious domains. The flaw occurs in how the DNS Security engine parses certain DNS packet structures. A specially crafted DNS packet triggers an unhandled condition in the parsing logic that causes the firewall's data plane process to crash, initiating an automatic system reboot.
The attack mechanism is straightforward: an attacker sends a malicious DNS packet through the firewall's data plane, which is the standard network traffic path. The packet does not need to be directed at the firewall itself; it only needs to transit through the device while DNS Security inspection is active. This means any external attacker capable of generating DNS traffic that passes through an affected firewall can trigger the vulnerability.
Affected versions include PAN-OS 11.2.0 through 11.2.2, PAN-OS 11.1.0 through 11.1.4, and specific maintenance releases of PAN-OS 10.1.14 and 10.2.8 through 10.2.13. Prisma Access environments running these PAN-OS versions are also affected. The critical aspect of this vulnerability is the cumulative effect: while a single exploitation causes a temporary outage during reboot, sustained exploitation forces the firewall into maintenance mode, a state requiring manual administrative recovery that can leave networks unprotected for extended periods.
Frequently Asked Questions
What is CVE-2024-3393?
CVE-2024-3393 is a Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software. It allows an unauthenticated attacker to crash and reboot a firewall by sending a specially crafted DNS packet through its data plane, and repeated attacks can force the firewall into maintenance mode.
How severe is CVE-2024-3393?
With a CVSS score of 7.5 (High) and an EPSS score of 78.02% at the 99th percentile, this is one of the most actively exploited firewall vulnerabilities. CISA has confirmed active exploitation and set a remediation deadline of January 20, 2025.
Which PAN-OS versions are affected?
Affected versions include PAN-OS 11.2.0 through 11.2.2, PAN-OS 11.1.0 through 11.1.4, and specific maintenance releases of PAN-OS 10.1.14 and 10.2.8 through 10.2.13. Prisma Access environments using these versions are also impacted.
Can the vulnerability be exploited without authentication?
Yes. The attack requires no authentication and no user interaction. Any attacker who can send DNS traffic through an affected PAN-OS firewall can trigger the vulnerability, making it exploitable from the internet against any firewall with DNS Security enabled.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.