Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-12-30
• EPSS: 29% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

CISA: Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 20 Jan 2025): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• security.paloaltonetworks.com/CVE-2024-3393Vendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource