CVE-2024-3393
📋 TL;DR
An unauthenticated attacker can send a malicious DNS packet through a Palo Alto Networks firewall's data plane, causing the firewall to reboot. Repeated exploitation forces the firewall into maintenance mode, resulting in complete network disruption. This affects organizations running vulnerable PAN-OS versions with DNS Security enabled.
💻 Affected Systems
- Palo Alto Networks PAN-OS
📦 What is this software?
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Prisma Access by Paloaltonetworks
⚠️ Risk & Real-World Impact
Worst Case
Firewall enters maintenance mode after repeated attacks, causing complete network outage until manual intervention restores service.
Likely Case
Firewall reboots unexpectedly, causing temporary network disruption and potential traffic loss during failover.
If Mitigated
With proper segmentation and monitoring, impact is limited to isolated network segments with quick detection and recovery.
🎯 Exploit Status
CISA has added this to Known Exploited Vulnerabilities catalog. Exploitation requires sending specially crafted DNS packets through data plane.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PAN-OS 11.1.2-h3, 11.0.4-h1, 10.2.9-h1, 10.1.14-h4
Vendor Advisory: https://security.paloaltonetworks.com/CVE-2024-3393
Restart Required: Yes
Instructions:
1. Download appropriate hotfix from Palo Alto support portal. 2. Upload to firewall. 3. Install hotfix. 4. Reboot firewall to complete installation.
🔧 Temporary Workarounds
Disable DNS Security
allTemporarily disable DNS Security feature to prevent exploitation while patching.
Navigate to Device > DNS Security > DNS Security Profile > Disable
Restrict DNS Traffic
allImplement strict firewall rules to limit DNS traffic to trusted sources only.
Create security policy restricting UDP/TCP port 53 to authorized DNS servers
🧯 If You Can't Patch
- Disable DNS Security feature immediately
- Implement strict network segmentation to limit exposure of vulnerable firewalls
🔍 How to Verify
Check if Vulnerable:
Check PAN-OS version and DNS Security status: show system info | match version; show running security-profile dns-securityCheck Version:
show system info | match versionVerify Fix Applied:
Verify installed version is patched: show system info | match version; show system software status📡 Detection & Monitoring
Log Indicators:
- Unexpected firewall reboots
- Maintenance mode entries in system logs
- DNS Security process crashes
Network Indicators:
- Unusual DNS traffic patterns to firewall interfaces
- Multiple malformed DNS packets
SIEM Query:
source="pan-firewall" AND (event="system-reboot" OR event="maintenance-mode")