erroneo.us
Search all guides⌘K

Security Digest · Dec 27, 2024 · Vulnerability · Network edge

PAN-OS CVE-2024-3393: DNS Security Packet Reboots Firewalls

A crafted DNS packet reboots PAN-OS firewalls with DNS Security logging on. Exploited Dec 2024; fixed in 11.2.3, 11.1.5, 10.2.14. Find stragglers and 11.0.

Published By erroneo.us Security Desk · Updated 3 min read5 sources

Our verdict

Check exposure

Fixed since early 2025 and a denial of service only; confirm no firewall with a DNS Security license and logging is still on an affected build, including end-of-life PAN-OS 11.0.

Who must act: Teams with PAN-OS firewalls licensed for DNS Security or Advanced DNS Security, with DNS Security logging enabled, still running an affected 10.1.14+, 10.2.8+, 11.0, 11.1 or 11.2 build.

Who can relax: Firewalls on any later fixed release, devices without a DNS Security license or with DNS Security log severity set to none, PAN-OS 10.2 before 10.2.8, 10.0 and 9.1, and Panorama and Cloud NGFW.

Affected
PAN-OS 11.2 before 11.2.3
PAN-OS 11.1 before 11.1.2-h16 / 11.1.3-h13 / 11.1.4-h7 / 11.1.5
PAN-OS 10.2.8 and later before 10.2.8-h19 / 10.2.9-h19 / 10.2.10-h12 / 10.2.11-h10 / 10.2.12-h4 / 10.2.13-h2 / 10.2.14
PAN-OS 10.1.14 before 10.1.14-h8 / 10.1.15
PAN-OS 11.0 (end of life, no fix)
Prisma Access on affected PAN-OS versions
Fixed in
PAN-OS 11.2.3
PAN-OS 11.1.5 (or 11.1.2-h16, 11.1.3-h13, 11.1.4-h7)
PAN-OS 10.2.14 (or the 10.2 hotfixes listed by the vendor, such as 10.2.10-h12)
PAN-OS 10.1.14-h8 or 10.1.15
Prisma Access: vendor-run upgrades scheduled for January 2025
CVSS
7.5 (v3.1, NVD)
EPSS
29.1% (percentile 98)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. List every firewall and its PAN-OS version with show system info.
  2. Run show config merged | match log-level to see whether DNS Security logging is on.
  3. Upgrade anything on an affected build to the fixed release for its train, or to a current supported release.
  4. Move any firewall still on end-of-life PAN-OS 11.0 to a supported train; until then set DNS Security log severity to none.
  5. If you used the log-severity workaround in 2025, restore your normal settings after upgrading.

How to check if you are affected or compromised

  • Check uptime in show system info and the system log for unexpected reboots, especially repeated ones that ended in maintenance mode.
  • Run show system files to look for crash or core files around the time of an outage.
  • Correlate reboot times with DNS Security entries in the threat log to find the triggering source.

What happened#

On December 27, 2024, Palo Alto Networks disclosed CVE-2024-3393, a flaw in how PAN-OS parses and logs malicious DNS packets in its DNS Security feature. An unauthenticated attacker can send a crafted packet through the firewall's data plane and make it reboot. Repeat the trick and the firewall drops into maintenance mode, which needs manual recovery. The vendor said it was "aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets," and it credited Estonia's CERT-EE with forensic help. BleepingComputer reported the outages the same day. No threat actor has been named as of Oct 23, 2026.

CISA added the CVE to the KEV catalog on December 30, 2024. NVD scores it CVSS 3.1 7.5. The vendor's CVSS 4.0 score is 8.7, or 7.1 for Prisma Access serving only authenticated users.

Who is affected#

Two conditions must both hold: the firewall has a DNS Security or Advanced DNS Security license, and DNS Security logging is enabled. Affected builds are PAN-OS 11.2 before 11.2.3, 11.1 before 11.1.5 (with hotfixes 11.1.2-h16, 11.1.3-h13 and 11.1.4-h7), 10.2.8 and later before the listed 10.2 hotfixes or 10.2.14, and 10.1.14 before 10.1.14-h8. PAN-OS 11.0 was affected but had reached end of life on November 17, 2024, so it never got a fix. Versions 10.2 before 10.2.8, 10.0 and 9.1 are unaffected, as are Panorama and Cloud NGFW. Palo Alto Networks scheduled Prisma Access upgrades for January 2025. The full table is on the CVE record.

Do you really need to act?#

Probably not, but check. This is a denial of service, not code execution or data theft, and the fixes are nearly two years old. A firewall still on one of these builds is also missing fixes for far worse PAN-OS bugs disclosed since, such as the management-interface RCE from October 2026, so finding one matters beyond this CVE.

The impact is not trivial for the firewalls that remain exposed. Anyone who can push a crafted DNS packet through the firewall can take it offline repeatedly, and maintenance mode means someone must recover the box by hand. The realistic stragglers are 11.0 boxes that were never moved off the end-of-life train and appliances frozen on an old 10.2 hotfix.

What to do now#

  1. Inventory firewalls and versions: run show system info on each and note sw-version.
  2. Check exposure with show config merged | match log-level. Empty output, or only log-level none;, means DNS Security logging is off and the firewall is not vulnerable.
  3. Upgrade any affected build to the fixed release for its train, or better, to a current supported release.
  4. Move 11.0 firewalls to a supported train. Until then, clone the predefined Anti-Spyware profiles and set the DNS Security log severity to "none" in each, as the advisory describes.
  5. If you applied that workaround in 2025 and have since upgraded, restore your DNS Security log severity so you keep the visibility.

How to tell if you were hit#

Exploitation shows up as outages, not stealth. Look for unexpected reboots in the system log and a short uptime in show system info, and check whether any firewall entered maintenance mode. Run show system files to list crash or core files around the outage. Then line up the reboot times with DNS Security entries in the threat log to find the source of the triggering traffic. The vendor has not published indicators of compromise for this bug.

Timeline#

  • — PAN-OS 11.0 reaches end of life.
  • — Palo Alto Networks publishes the advisory, citing customer outages.
  • — CISA adds CVE-2024-3393 to KEV.
  • — Prisma Access upgrades begin, with a second phase the following weekend.
  • — The advisory corrects the 11.1.4 fix to 11.1.4-h7.

Vulnerability records

  • CVE-2024-3393 · KEV 2024-12-30 · A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Palo Alto Networks — CVE-2024-3393 PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet security.paloaltonetworks.com
  2. CVE record — CVE-2024-3393 cve.org
  3. NVD — CVE-2024-3393 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2024-3393 cisa.gov

Coverage and analysis

  1. BleepingComputer — Hackers exploit DoS flaw to disable Palo Alto Networks firewalls bleepingcomputer.com