CVE-2024-3393: PAN-OS DNS Security packet causes firewall reboot and maintenance mode

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityUnauthenticated remote denial of service against a perimeter firewall, with confirmed KEV exploitation and high EPSS, though impact is availability only.

What it is

A denial of service flaw in the DNS Security feature of Palo Alto Networks PAN-OS lets an unauthenticated attacker send a crafted packet through the firewall data plane that reboots the device. Repeated triggers push the firewall into maintenance mode, taking it fully offline. Because the firewall is a perimeter control, this can disrupt all protected traffic, not just DNS inspection.

Impact

An attacker can repeatedly reboot a targeted firewall and force it into maintenance mode, causing sustained loss of availability for the network it protects. No data is read or altered; the gain is purely denial of service.

Attack surface

Reachable over the network through the data plane with no authentication and no user interaction, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). The DNS Security feature must be in use for the malicious packet to be processed.

Exploitation

Listed in CISA KEV with a due date of 2025-01-20, indicating known exploitation in the wild. EPSS is 0.284 (98th percentile), so short-term exploitation likelihood is elevated.

What to do

• Apply the vendor fix from the Palo Alto Networks advisory for CVE-2024-3393; patch is the primary action.
• If patching cannot be done immediately, follow the vendor's stated mitigations or disable the affected DNS Security functionality until fixed.
• Restrict management and data-plane exposure of PAN-OS firewalls to trusted networks where operationally possible.
• Monitor for repeated firewall reboots or unexpected maintenance-mode transitions and treat them as potential attack activity.
• Track the CISA KEV due date of 2025-01-20 and confirm remediation before it lapses.

Detection

• Alert on unexpected PAN-OS reboots or transitions into maintenance mode, especially clustered or repeated events.
• Review firewall and system logs for DNS Security processing anomalies or crashes correlated with inbound DNS traffic.
• Baseline normal reboot cadence and flag deviations; correlate with spikes in DNS packets to the data plane.
• Check for repeated reboot cycles within short windows that match the repeated-trigger pattern described in the advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.