UpHeron
All vulnerabilities

Servers and applications

CVE-2024-3393

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 30 Dec 2024.

Severity
High 8.7
Published
27 Dec 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.2.3
Sources
NVD

Affected software

SoftwareAffected versions
Palo Alto Networks PAN-OSServers and applications · cpe:o:paloaltonetworks:pan-os
  • From 11.2.0 before 11.2.3
  • Version 11.1.4-h4
  • Version 11.1.4-h1
  • Version 11.1.4
All 59 release lines
  • Version 10.1.14
  • Version 10.1.14-h2
  • Version 10.1.14-h4
  • Version 10.1.14-h6
  • Version 10.2.8
  • Version 10.2.8-h3
  • Version 10.2.8-h4
  • Version 10.2.8-h10
  • Version 10.2.8-h13
  • Version 10.2.8-h15
  • Version 10.2.8-h18
  • Version 10.2.9
  • Version 10.2.9-h1
  • Version 10.2.9-h9
  • Version 10.2.9-h11
  • Version 10.2.9-h14
  • Version 10.2.9-h16
  • Version 10.2.9-h18
  • Version 10.2.10
  • Version 10.2.10-h2
  • Version 10.2.10-h3
  • Version 10.2.10-h4
  • Version 10.2.10-h5
  • Version 10.2.10-h7
  • Version 10.2.10-h9
  • Version 10.2.10-h10
  • Version 10.2.11
  • Version 10.2.11-h1
  • Version 10.2.11-h2
  • Version 10.2.11-h3
  • Version 10.2.11-h4
  • Version 10.2.11-h6
  • Version 10.2.11-h9
  • Version 10.2.12
  • Version 10.2.12-h1
  • Version 10.2.12-h2
  • Version 10.2.12-h3
  • Version 10.2.13
  • Version 10.2.13-h1
  • From 11.1.0 up to 11.1.1
  • Version 11.1.2
  • Version 11.1.2-h1
  • Version 11.1.2-h3
  • Version 11.1.2-h4
  • Version 11.1.2-h9
  • Version 11.1.2-h12
  • Version 11.1.2-h14
  • Version 11.1.2-h15
  • Version 11.1.3
  • Version 11.1.3-h1
  • Version 11.1.3-h2
  • Version 11.1.3-h4
  • Version 11.1.3-h6
  • Version 11.1.3-h10
  • Version 11.1.3-h11
  • Version 11.1.4
  • Version 11.1.4-h1
  • Version 11.1.4-h4
  • From 11.2.0 before 11.2.3

Known exploited

CISA name
Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
20 Jan 2025
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-3393
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-3393