Emerging Threat: Palo Alto PAN-OS CVE-2024-3393 

What is CVE-2024-3393? 

CVE-2024-3393 is a high severity (CVSS v4.0 score 8.7) Denial of Service (DoS) vulnerability affecting specific versions of Palo Alto Networks PAN-OS DNS Security feature. 

This vulnerability allows unauthenticated attackers to send malicious packets through the data plane of the firewall. This forces the firewall to reboot. Repeated attempts can force the firewall into maintenance mode, requiring security teams to manually reset the firewall and significantly disrupting operations. 

What assets are affected by CVE-2024-3393? 

Both of the following must be true for PAN-OS software to be affected:

• DNS Security License (standard or advanced) must be applied.
• DNS Security Logging must be enabled.

These configurations are internal settings and cannot be identified via external scanning. Organizations with PAN-OS versions within the affected range should consider these assets potentially vulnerable until internal settings are verified.

The following assets are potentially affected by CVE-2024-3393: 

• PAN-OS 11.2 < 11.2.3
• PAN-OS 11.1 < 11.1.5
• PAN-OS 10.2 >= 10.2.8, < 10.2.14
• PAN-OS 10.1 >= 10.1.14, < 10.1.15
• Prisma Access >= 10.2.8 on PAN-OS, < 11.2.3 on PAN-OS

The following assets are not affected by CVE-2024-3393: 

• PAN-OS 11.2 >= 11.2.3
• PAN-OS 11.1 >= 11.1.5
• PAN-OS 10.2 < 10.2.8, >= 10.2.14
• PAN-OS 10.1 < 10.1.14, >= 10.1.15
• Prisma Access < 10.2.8 on PAN-OS, >= 11.2.3 on PAN-OS
• PAN-OS 9.1 (all versions)
• Cloud NGFW (all versions)

Are fixes available? 

Upgrading to PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions resolves this issue. Note that PAN-OS 11.0 is End of Life (EOL) and will not be updated. 

Palo Alto Networks also announced additional releases for commonly deployed maintenance versions. 

​​Additional PAN-OS 11.1 releases with the fix:

• 11.1.2-h16 (available)
• 11.1.3-h13 (available)
• 11.1.4-h7 (available)
• 11.1.5 (available)

Additional PAN-OS 10.2 releases with the fix:

• 10.2.8-h19 (ETA: Dec 31)
• 10.2.9-h19 (available)
• 10.2.10-h12 (available)
• 10.2.11-h10 (ETA: Dec 31)
• 10.2.12-h4 (ETA: Dec 31)
• 10.2.13-h2 (ETA: Dec 31)
• 10.2.14 (ETA: end of Jan)

Additional PAN-OS 10.1 releases with the fix:

• 10.1.14-h8 (available)
• 10.1.15 (ETA: end of Jan)

Additional PAN-OS releases with the fix only applicable to Prisma Access:

• 10.2.9-h19 (available)
• 10.2.10-h12 (available)

Are there any other recommended actions to take? 

If affected firewalls stop responding or reboot unexpectedly, Palo Alto Networks has provided several workarounds, including specific workarounds for Prisma Access customers using DNS Security. 

Is CVE-2024-3393 being actively exploited? 

Palo Alto Networks has confirmed active exploitation, though no public proof-of-concept (PoC) tools currently exist. 

What types of organizations are at risk from CVE-2024-3393? 

Because Palo Alto Networks products are incredibly common across enterprises globally, this vulnerability potentially affects a significant number of organizations. We’ve previously reported that over 50% of CyCognito customers use at least one externally exposed Palo Alto Networks product, and the larger the organization is, the more vulnerable devices it has. 

This vulnerability’s resistance to external scanning and testing intensifies the challenge of diagnosing and fixing affected devices, as security teams must verify the internal setting of all networks with an associated device individually. For large enterprises like Fortune 100 companies, that can mean checking the settings on up to 150 different networks across dozens of brands and subsidiaries.    

How is CyCognito helping customers identify assets vulnerable to CVE-2024-3393? 

Because the vulnerable configurations are entirely internal, external scanning or testing cannot verify if potentially affected assets are actually exploitable. To accelerate remediation efforts, CyCognito has shared lists of potentially affected assets running PAN-OS with affected customers alongside a notification in-platform.

Figure 1: The alert sent by CyCognito for CVE-2024-3393

How can CyCognito help your organization? 

CyCognito is an exposure management platform that reduces risk by discovering, testing and prioritizing security issues. The platform scans billions of websites, cloud applications and APIs and uses advanced AI to identify the most critical risks and guide remediation. Emerging companies, government agencies and Fortune 500 organizations rely on CyCognito to secure and protect from growing threats. Want to see how it works? Check out our website and explore our platform with a self-guided, interactive dashboard product tour. To learn how CyCognito can help you understand your external attack surface and exposed risks, please visit our Contact Us page to schedule a demo.