CVE-2024-3393

What it actually does

CVE-2024-3393 is an unauthenticated denial-of-service flaw in the Palo Alto Networks PAN-OS DNS Security feature. A specially crafted DNS packet traversing the firewall data plane can trigger a firewall reboot. Repeated triggering can force the appliance into maintenance mode, removing it from normal traffic-forwarding operation and potentially disrupting perimeter, segmentation, VPN, and inspection services.

Why it matters to the business

Successful exploitation can cause firewall outages, degraded network availability, failed internet or site-to-site connectivity, and interruption of business services protected by affected PAN-OS devices. Because this vulnerability is in CISA KEV, has active in-the-wild exploitation, and had a KEV remediation deadline of 2025-01-20, organizations should treat any exposed or DNS Security-enabled deployment as a high-priority operational risk even though the impact is denial of service rather than data theft. The EPSS score of 0.28617 indicates meaningful exploitation likelihood, and the issue has remained relevant well after publication.

How an attack unfolds

An attacker does not need credentials or management-plane access. They craft a malicious DNS packet and cause it to pass through the affected firewall data plane where DNS Security inspection is active. The PAN-OS DNS Security processing path mishandles the packet and reboots the firewall. If the attacker repeats the activity, the firewall can repeatedly crash and eventually enter maintenance mode, leaving the device unable to enforce policy or forward traffic normally until recovered. Public reporting and KEV status indicate active exploitation behavior associated with malicious DNS-packet campaigns targeting PAN-OS devices.

How to fix it

Upgrade affected PAN-OS devices to a vendor-fixed release for the deployed PAN-OS branch. Because fixed_versions were not provided in the input, validate exact target versions against the current Palo Alto Networks security advisory for CVE-2024-3393 and install the latest preferred maintenance release available for each supported branch. Prioritize devices with DNS Security enabled, internet-facing traffic paths, high-availability roles, branch connectivity, VPN termination, or critical segmentation duties. If immediate patching is not possible, apply vendor-recommended mitigations for DNS Security, reduce unnecessary DNS inspection exposure where operationally acceptable, use upstream filtering where feasible, and ensure high-availability failover is healthy. Do not rely on management-plane ACLs alone, because exploitation occurs through data-plane traffic.

How to confirm the fix worked

Confirm the running PAN-OS version is at or above the vendor-fixed version for its release branch. Verify that the device has successfully rebooted into the upgraded image, content updates are current, HA peers are both remediated, and no peer remains on a vulnerable version. Review configuration to determine whether DNS Security is enabled and whether DNS traffic traverses the firewall. Validate that recent system logs no longer show unexplained reboot loops, crash events, or maintenance-mode transitions after upgrade. Where possible, use vendor-provided checks, advisory guidance, and support tools rather than attempting live exploit reproduction in production.

Typical attack path

1. Identify an organization using Palo Alto Networks PAN-OS firewalls with DNS Security enabled or likely deployed at an internet, branch, or data-center boundary.
2. Send specially crafted DNS traffic through the firewall data plane rather than to the management interface.
3. Trigger the PAN-OS DNS Security processing flaw, causing the firewall to reboot.
4. Repeat malicious DNS packet delivery to cause recurring reboots.
5. Force the appliance into maintenance mode, resulting in sustained network disruption until administrative recovery or upgrade is performed.

How to detect it

Look for evidence of prior exploitation by correlating PAN-OS system logs, traffic logs, threat logs, HA logs, crash reports, and operational monitoring. Focus on unexplained firewall reboots, dataplane restarts, transitions into maintenance mode, HA failovers, and repeated outage events coinciding with inbound or transit DNS traffic. Review logs around availability incidents for abnormal DNS packet rates, unusual DNS sources, malformed DNS behavior, or repeated attempts shortly before each reboot. On devices that entered maintenance mode, preserve tech support files, core/crash artifacts, system logs, and configuration state before rebuilding or reinstalling. Network telemetry may show bursts of DNS traffic to or through the firewall immediately before reboot; however, there is no single universally reliable public packet signature for the malicious payload, so detection should rely on crash/reboot symptoms plus DNS traffic correlation. If threat actor or campaign intelligence is available from Palo Alto Networks, CISA, or ISAC sources, enrich searches with reported source infrastructure and timestamps.

• maintenance mode
• Maintenance mode
• reboot
• Reboot
• unexpected reboot
• system restart
• dataplane restart
• dataplane crash
• PAN-OS
• DNS Security
• dns-security
• port 53
• udp/53
• tcp/53

What your security team should do

• Immediately inventory Palo Alto Networks PAN-OS firewalls and identify devices with DNS Security enabled or DNS traffic traversing the data plane.
• Patch or upgrade affected devices to vendor-fixed PAN-OS releases, prioritizing internet-edge, VPN, datacenter, and HA-pair firewalls.
• Treat this as overdue if not remediated, because it is listed in CISA KEV with a remediation deadline of 2025-01-20 and has active exploitation reported.
• Review system, threat, traffic, and HA logs for unexplained firewall reboots, dataplane crashes, maintenance-mode entries, and DNS traffic spikes around outage windows.
• Confirm both members of HA pairs are upgraded; do not leave passive peers vulnerable.
• Ensure backups of PAN-OS configuration are current before remediation and that out-of-band access is available in case a device enters maintenance mode.
• If patching is delayed, implement vendor-approved mitigations and consider temporary DNS Security exposure reduction where business risk allows.
• Create monitoring alerts for repeated PAN-OS reboots, maintenance-mode transitions, and anomalous DNS traffic patterns crossing protected zones.