CVE-2024-3393

Palo Alto Networks PAN-OS contains a flaw (CWE-754) in how the DNS Security feature parses and logs malicious DNS packets, which an unauthenticated remote attacker can abuse by sending crafted DNS traffic to a firewall with the feature enabled. Successful exploitation triggers a remote reboot of the firewall, and repeated exploitation attempts can push the device into maintenance mode, causing a sustained denial of service until an administrator intervenes. Only PAN-OS deployments that use the DNS Security feature are affected; the attacker requires no credentials, only network reachability to traffic inspected by the firewall. The flaw was added to the CISA KEV catalog on 2024-12-30, indicating confirmed in-the-wild exploitation, and its EPSS score of 28.4% (98th percentile) signals elevated exploitation risk, though no public proof-of-concept code is known and CVSS scoring is not yet available.

What to do: Check the Palo Alto Networks advisory for this CVE to determine whether your PAN-OS release with DNS Security enabled is affected, and upgrade to the recommended fixed hotfix release per vendor instructions; if mitigations are unavailable, CISA's KEV guidance is to discontinue use of the affected product. Limit exposure of firewall interfaces and DNS Security processing paths to untrusted DNS traffic, and monitor devices for unexplained reboots or entry into maintenance mode, which would indicate exploitation attempts.