Loading vulnerability…
Unauthenticated Denial of Service in PAN-OS DNS Security
CVE-2024-3393 is a denial-of-service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS. Improper handling of exceptional conditions during DNS Security processing allows an unauthenticated remote attacker to send a specially crafted DNS packet through the firewall data plane and trigger a firewall reboot. Repeated exploitation can force the device into maintenance mode. Exploitation requires DNS Security logging to be enabled and an active DNS Security or Advanced DNS Security license. Affected deployments include PA-Series, VM-Series, CN-Series, and Prisma Access running vulnerable PAN-OS releases. The vulnerability has been actively exploited and is included in CISA's Known Exploited Vulnerabilities catalog.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation interrupts firewall operation and network availability by causing device reboots. Repeated triggering can place the firewall into maintenance mode, leaving it unavailable for normal traffic processing and security enforcement. The demonstrated impact is denial of service; arbitrary code execution, privilege escalation, and data disclosure are not established.
If you can’t patch tonight, do this now.
Where immediate upgrading is not possible, disable DNS Security logging by setting DNS Security log severity to "none" in the applicable custom Anti-Spyware profiles. If security policies use predefined profiles, clone them into custom profiles, apply the logging change, and replace the predefined profiles in the affected policies. Disabling logging reduces visibility into DNS-based threats. Monitor for unexpected reboots and maintenance-mode transitions; monitoring alone does not prevent exploitation.
Patch, then assume compromise.
Upgrade affected deployments to a vendor-designated fixed PAN-OS release. Fixed maintenance releases include PAN-OS 10.1.15, 10.2.14, 11.1.5, and 11.2.3, or later fixed releases in the respective branches. PAN-OS 10.1.14-h8 is also identified as a fixed hotfix. Select the appropriate upgrade or hotfix for the installed branch using the vendor's CVE-2024-3393 advisory, and ensure affected Prisma Access deployments receive the corresponding update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.