CVE-2024-3393

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.291 · 98 %ileDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV

Likely / severe?

29.1% (98th) EPSS

CVSS 7.5 · high

Is it mine?

41 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2024-12-30remediate by 2025-01-20

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-23

Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRUGGEDCOM APE1808siemens_psirt
Upgrade Palo Alto Networks Virtual NGFW V11.1.8. Contact customer support to receive patch and update information
FixedRUGGEDCOM APE1808cisa_csaf_ot
Upgrade Palo Alto Networks Virtual NGFW V11.1.8. Contact customer support to receive patch and update information
MitigationRUGGEDCOM APE1808siemens_psirt
For upstream mitigation measures, refer to Palo Alto Networks' Security Advisory
MitigationRUGGEDCOM APE1808cisa_csaf_ot
For upstream mitigation measures, refer to Palo Alto Networks' Security Advisory

cvss

Technical severity, 0–10. One row per scoring source.

8.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Siemens ProductCERT DE

v3.18.6highAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Ambersecondary · ENISA EU

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Ambersecondary · psirt@paloaltonetworks.com

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Ambersecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-754USprimaryCWE-754USCWE-754USCWE-754USCWE-754US

affected products (41)

Products and version ranges known to be affected.

PaloAlto Networks PAN-OS <10.1.14-h8all versionscert_bundDE
PaloAlto Networks PAN-OS <10.2.10-h12all versionscert_bundDE
PaloAlto Networks PAN-OS <10.2.13-h2all versionscert_bundDE
PaloAlto Networks PAN-OS <11.1.5all versionscert_bundDE
PaloAlto Networks PAN-OS <11.2.3all versionscert_bundDE
Palo Alto Networks PAN-OS< 10.1.14-h8cert_bundDE
Palo Alto Networks PAN-OS< 10.2.10-h12cert_bundDE
Palo Alto Networks PAN-OS< 10.2.13-h2cert_bundDE
Palo Alto Networks PAN-OS< 11.1.5cert_bundDE
Palo Alto Networks PAN-OS< 11.2.3cert_bundDE
RUGGEDCOM APE1808all versionscisa_csaf_otUS
Siemens RUGGEDCOM APE1808≤ vers:all/*cisa_csaf_otUS
Palo Alto Networks PAN-OS10.1.14 → 10.1.14-h8enisa_euvdEU
Palo Alto Networks PAN-OS10.2.8 → 10.2.8-h19enisa_euvdEU
Palo Alto Networks PAN-OS11.1.0 → 11.1.2-h16enisa_euvdEU
Palo Alto Networks PAN-OS11.2.0 → 11.2.3enisa_euvdEU
Palo Alto Networks Inc. PAN-OS≤ 10.1.14-h8fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 10.2.13-h2fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 10.2.10-h12fstec_bduRU
Palo Alto Networks Inc. PAN-OS≤ 11.1.5fstec_bduRU

showing 20 of 41

advisories (4)

Vendor and ecosystem advisories describing this.

NCSC-2024-0499Kwetsbaarheid verholpen in Palo Alto Networks PAN-OSNL2024-12-27csaf · ncsc_nlNL
Palo Alto Networks heeft een kwetsbaarheid verholpen in PAN-OS.
SSA-354569SSA-354569: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices2024-11-22csaf · siemens_psirtDE
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/
WID-SEC-W-2024-3753PaloAlto Networks PAN-OS: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-12-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PaloAlto Networks PAN-OS ausnutzen, um einen Denial of Service Angriff durchzuführen.
ICSA-24-338-02Siemens RUGGEDCOM APE18082024-11-22icsa · cisa_csaf_otUS
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2024-12-27modified 2026-06-17

related (781)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-39682US	critical9.8OT critical	2.88% (87th)	KEV	2025-09-05
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contig…
CVE-2023-41993US	high8.8OT critical	24.3% (98th)	KEV	2023-09-21
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that t…
CVE-2023-41992US	high7.8OT critical	9.52% (95th)	KEV	2023-09-21
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate thei…
CVE-2021-3560US	high7.8OT critical	23.7% (98th)	KEV	2022-02-16
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be us…
CVE-2024-4367US	high8.8	70.7% (99th)	Exploit	2024-05-14
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ES…

+776 more

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan