About Denial of Service – PAN-OS (CVE-2024-3393) vulnerability. PAN-OS is the operating system that runs all Palo Alto Network NGFWs. The vendor’s advisory was released on December 27. Аn unauthenticated attacker can send a malicious packet through the data plane of the firewall, causing it to reboot. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. For exploitation the logging option of the “DNS Security” feature must be enabled.

Palo Alto has already detected attacks that exploit this vulnerability. There are no public exploits yet.

CyberOK detects more than 500 PAN-OS installations in RuNet, of which 32 are potentially vulnerable. Additionally, 218 hosts are running PAN-OS version 11.0.x, which is no longer supported by the vendor since November 17.

To fix the vulnerability, you need to update your device or, as a workaround, disable the logging option of the “DNS Security” function.

На русском