CVE-2024-3385: PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-10 · updated 2026-06-17
Weakness: CWE-20

Description

A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online. This affects the following hardware firewall models: - PA-5400 Series firewalls - PA-7000 Series firewalls

Affected products

Palo Alto Networks PAN-OS: from 9.0.0 through 9.0.16; from 9.1.0 before 9.1.17; from 10.1.0 before 10.1.12; from 10.2.0 before 10.2.8; from 11.0.0 before 11.0.3; 9.0.17-h1 — fixed in 9.1.17, 10.1.12, 10.2.8, 11.0.3
Palo Alto Networks PAN-OS: from 9.0.0 before 9.0.17-h4; from 9.1.0 before 9.1.17; from 10.1.0 before 10.1.12; from 10.2.0 before 10.2.8; from 11.0.0 before 11.0.3 — fixed in 9.0.17-h4, 9.1.17, 10.1.12, 10.2.8, 11.0.3

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 9.1.17, 10.1.12, 10.2.8, 11.0.3; Palo Alto Networks PAN-OS 9.0.17-h4, 9.1.17, 10.1.12, 10.2.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3385 or the next vulnerability affects your stack