PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

Description

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Scores

EPSS (exploitation in 30 days)

29.1% · top 1.8% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: active · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

• CWE-754 Improper Check for Unusual or Exceptional Conditions (opens in a new tab)All about CWE-754 and its CVEs

Affected products

• Palo Alto Networks · Cloud NGFW

  • unaffected All

• Palo Alto Networks · PAN-OS

  • affected 11.2.0 – < 11.2.3
  • affected 11.1.0 – < 11.1.2-h16
  • affected 10.2.8 – < 10.2.8-h19
  • affected 10.1.14 – < 10.1.14-h8

• Palo Alto Networks · PAN-OS

  • unaffected 10.2.0 – < 10.2.8
  • affected 11.2.0 – < 11.2.3

What to do

Solution: This issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions. Note: PAN-OS 11.0 reached the end of life (EOL) on November 17, 2024, so we do not intend to provide a fix for this release. Prisma Access customers using DNS Security with affected PAN-OS versions should apply one of the workarounds provided below. We will perform upgrades in two phases for impacted customers on the weekends of January 3rd and January 10th. You can request an expedited Prisma Access upgrade to the latest PAN-OS version by opening a support case https://support.paloaltonetworks.com/Support/Index . In addition, to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases. ​​Additional PAN-OS 11.1 fixes: * 11.1.2-h16 * 11.1.3-h13 * 11.1.4-h7 * 11.1.5 Additional PAN-OS 10.2 fixes: * 10.2.8-h19 * 10.2.9-h19 * 10.2.10-h12 * 10.2.11-h10 * 10.2.12-h4 * 10.2.13-h2 * 10.2.14 Additional PAN-OS 10.1 fixes: * 10.1.14-h8 * 10.1.15 Additional PAN-OS fixes only applicable to Prisma Access: * 10.2.9-h19 * 10.2.10-h12

Workaround: If your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama * For each Anti-spyware profile, navigate to Objects → Security Profiles → Anti-spyware → (select a profile) → DNS Policies → DNS Security. * Change the Log Severity to "none" for all configured DNS Security categories. * Commit the changes. Remember to revert the Log Severity settings once the fixes are applied. NGFW managed by Strata Cloud Manager (SCM) You can choose one of the following mitigation options: * Option 1: Disable DNS Security logging directly on each NGFW by following the PAN-OS steps above. * Option 2: Disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index . Prisma Access managed by Strata Cloud Manager (SCM) Until we perform an upgrade of your Prisma Access tenant, you can disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index . If you would like to expedite the upgrade, please make a note of that in the support case.

Exploitation: Palo Alto Networks is aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue.

References (2)

• https://security.paloaltonetworks.com/CVE-2024-3393 (opens in a new tab)vendor-advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3393 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• CISA KEV catalog (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-3393](https://trackcve.app/badge/CVE-2024-3393.svg)](https://trackcve.app/cve/CVE-2024-3393)

Record last updated 21 Oct 2025, 22:55 UTC.