DaystoPatch

Palo Alto NetworksExploited incident

PAN-OS DNS Security denial of service from a crafted packet (exploited)

CVE-2024-3393High, CVSS 8.7In CISA's Known Exploited Vulnerabilities catalog since 30 Dec 2024

  • Exploited after a fix existed
FixedFixed for every supported version 7.4 days after the first public report.

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
7.4d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Palo Alto Networks advisory CVE-2024-3393 (advisory page)CuratedQuote verified

    2024-12-27 Initial publication

    PAN's advisory, which already said customers were experiencing the DoS, is the first public signal found. Time from this timeline entry's data-date attribute (2024-12-27T02:30:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5cc5f8c3dd66ca8b…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    Bluesky postClaimedQuote not checked yet27 Dec 2024, 03:03 UTC

    Paloaltoの脆弱性情報 「CVE-2024-3393 PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet (Severity: HIGH)」が公開されました。

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2024-3393ClaimedQuote verified27 Dec 2024, 09:44 UTC

    A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c8dcb6ff0f5afa45…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-3393)ClaimedQuote verified30 Dec 2024

    Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

    Added to CISA's KEV catalog on 2024-12-30.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Palo Alto Networks advisory CVE-2024-3393 (advisory page)CuratedQuote verified

    2024-12-27 Initial publication

    Time from this timeline entry's data-date attribute (2024-12-27T02:30:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5cc5f8c3dd66ca8b…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    at disclosure

    Palo Alto Networks advisory CVE-2024-3393 (Wayback snapshot 2024-12-27 03:22 UTC)CuratedQuote verified

    If your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment.

    Workarounds in the first capture, 52 minutes after initial publication.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ed701f5b452bf899…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    Palo Alto Networks advisory CVE-2024-8686 (shows PAN-OS 11.2.3 already released)CuratedQuote verified

    This issue is fixed in PAN-OS 11.2.3 and all later PAN-OS versions.

    PAN-OS 11.2.3 is a listed fix for CVE-2024-3393 ('This issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions'). This separate PAN advisory, published 2024-09-11T16:00Z (data-date of its '2024-09-11 Initial publication' timeline entry), already names 11.2.3 as a shipping release. Upper bound: 11.2.3 may have shipped earlier; its own release date was not found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:63498ccefde81574…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks advisory CVE-2024-3393 (Wayback snapshot 2024-12-27 03:22 UTC)CuratedQuote verified27 Dec 2024, 02:30 UTC

    This issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions.

    Not the first fix: 11.2.3 and 11.1.5 had shipped weeks earlier (see the CVE-2024-8686-sourced candidate). This is the advisory listing the fixes at publication (time from the timeline's initial publication).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ed701f5b452bf899…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +7.4d

    Palo Alto Networks advisory CVE-2024-3393 (Wayback snapshot 2025-01-03 11:36 UTC)CuratedQuote verified

    10.2.13-h2 (available)

    Maintenance-line granularity (R6): the last hotfixes for affected 10.2 maintenance lines (10.2.8-h19, 10.2.11-h10, 10.2.12-h4, 10.2.13-h2) were marked '(ETA: Dec 31)' in the 2024-12-30T18:03Z capture and '(available)' in this capture, so they shipped between those times; the capture time is used as an upper bound (no timeline entry records the release). 10.2.14 and 10.1.15 are new maintenance releases (ETAs slipped to early March / end of February 2025) and are not needed to fix any existing line, so they are not counted.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:187aab1a55a90d6b…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. CVE-2024-3393

    Recorded in the revision history

    Palo Alto Networks Security Advisories /

    Version table: 1 row added and 1 row removed. One new row reads "PAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h7 >= 11.1.5".

    • Fixed versions
    Version table rows
    BeforePAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h6 >= 11.1.5
    AfterPAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h7 >= 11.1.5
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    ma Access. Product Status Versions | Affected | Unaffected Cloud NGFW | None | All PAN-OS | None on Panorama | All on Panorama PAN-OS 11.2 | = 11.2.3 PAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h6 >= 11.1.5 PAN-OS 10.2 | >= 10.2.8 = 10.2.8-h19 >= 10.2.9-h19 >= 10.2.10-h12 >= 10.2.11-h10 >= 10.2.12-h4 >= 10.2.13-h2 >= 10.2.14 PAN-OS 10.1 | >= 10.1.14 = 10.1.14-h8 >= 10.1.15 PAN-OS 10.0 | Non

    After

    ma Access. Product Status Versions | Affected | Unaffected Cloud NGFW | None | All PAN-OS | None on Panorama | All on Panorama PAN-OS 11.2 | = 11.2.3 PAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h7 >= 11.1.5 PAN-OS 10.2 | >= 10.2.8 = 10.2.8-h19 >= 10.2.9-h19 >= 10.2.10-h12 >= 10.2.11-h10 >= 10.2.12-h4 >= 10.2.13-h2 >= 10.2.14 PAN-OS 10.1 | >= 10.1.14 = 10.1.14-h8 >= 10.1.15 PAN-OS 10.0 | Non

    Earlier version captured 25 Jan 2025, 08:52 UTC: archived copyLater version captured 4 Feb 2025, 03:29 UTC: archived copyRecovered from archived copiesSnapshots 3842de1d89… and 50d153968a…Incident page

  2. CVE-2024-3393

    Recorded in the revision history

    Palo Alto Networks Security Advisories /

    Workaround text changed.

    • Workaround
    Workaround
    BeforeIf your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama Within Objects → Security Profil
    AfterIf your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama Ensure that a DNS Security Confi
    Earlier version captured 17 Jan 2025, 21:00 UTC: archived copyLater version captured 25 Jan 2025, 08:52 UTC: archived copyRecovered from archived copiesSnapshots d715874d06… and 3842de1d89…Incident page

  3. CVE-2024-3393

    Recorded in the revision history

    Palo Alto Networks Security Advisories /

    Workaround text changed.

    • Workaround
    Workaround
    BeforeIf your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama For each Anti-spyware profile, n
    AfterIf your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama Within Objects → Security Profil
    Earlier version captured 30 Dec 2024, 18:03 UTC: archived copyLater version captured 3 Jan 2025, 11:36 UTC: archived copyRecovered from archived copiesSnapshots 7acedb4975… and 89a76cce7f…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • PAN-OS (PA-Series, VM-Series, CN-Series firewalls with DNS Security)
  • Prisma Access
How we built this timeline

Exploitation was acknowledged at first publication ('Palo Alto Networks is aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue.'), but fixed releases (11.2.3, 11.1.5) were already publicly available weeks earlier, so under rule R4 exploited before a fix is false (corrected from true on 23 Oct 2026). Requires DNS Security licence and DNS Security logging.

Timeline: 27 Dec 2024 initial; 18:40Z ETAs added; 30 Dec 2024 affected products clarified; 30 Jan 2025 corrected 11.1.4 fix to 11.1.4-h7. KEV 30 Dec 2024.

CVSS-B 8.7.

Related

Palo Alto Networks report card