This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Palo Alto Networks PAN-OS fixes a high-severity vulnerability

Palo Alto Networks versions 11.2.3, 11.1.5, 10.2.14 and 10.1.15 fix a high-severity and actively exploited vulnerability in PAN-OS [1][2]. The vulnerability affects PA-Series, VM-Series and CN-Series firewalls and the Prisma Access platform. If the product cannot be updated to the fixed version, it is recommended to apply the temporary mitigations described at [1]. Applying the temporary mitigation is also recommended for Prisma Access users who use DNS Security on an affected PAN-OS version. Scheduled upgrades of these systems will be carried out over the next two weekends. An expedited upgrade can be requested from technical support [1].

Palo Alto Networks PAN-OS - denial of service (CVE-2024-3393)
CVSS 7.5 (High)

An unauthenticated remote attacker can restart the victim's firewall using specially crafted DNS packets and, by sending them repeatedly, carry out a DoS attack. This vulnerability affects systems running PAN-OS with an active DNS Security or Advanced DNS Security license and with DNS Security logging enabled [1].

The vulnerability is present in products:

  • Palo Alto Networks PAN-OS; >=10.1.14, <10.1.15; >=10.2.8, <10.2.14; >=11.1, <11.1.5; >=11.2, <11.2.3;
  • Palo Alto Networks PAN-OS (Prisma Access); >=10.2.8, <11.2.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 27. 12. 2024.

By CESNET, z.s.p.o. Michaela Ručková on 2. 1. 2025.

CESNET, z.s.p.o. Logo