CVE-2024-2551 is a high severity (CVSS 7.5) NULL pointer dereference in Palo Alto Networks PAN-OS. A crafted packet through the data plane can stop a core system service. Upgrade to PAN-OS 10.1.14, 10.2.4-h6, 10.2.5, 11.0.5 or later, per the vendor advisory.
What's affected
PAN-OS firewalls. No special configuration is required to be affected, per the advisory. It lists 11.0 before 11.0.5, 10.2 before 10.2.4-h6 (and 10.2.5 as a fixed release) and 10.1 before 10.1.14 as affected. PAN-OS 11.2 and 11.1, Cloud NGFW and Prisma Access are listed as unaffected.
The advisory scores it 6.6 (medium, CVSS-BT) and 8.7 on its base score, using CVSS 4.0. NVD lists 7.5 (high) under CVSS 3.1. The scoring systems differ and I report both.
The NVD record scores it 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, published 2024-11-14. The weakness is classed as CWE-476 (NULL pointer dereference).
The advisory says it is fixed in PAN-OS 10.1.14, 10.2.4-h6, 10.2.5, 11.0.5 and all later versions. It says no workaround or mitigation is available.
How to check if you're exposed
No special configuration is needed to be affected, so every firewall on an affected release counts. Read the version:
show system info | match sw-version
Compare the result to the fixed versions above, taking your release train into account.
What to do now
- Read the PAN-OS version on every firewall with the command above.
- Upgrade to a fixed release such as 10.1.14, 10.2.4-h6, 10.2.5 or 11.0.5, or later.
- Plan a maintenance window, since no workaround exists.
- Include Panorama managed firewalls in the inventory so none are missed.
- Watch for unexpected service restarts or maintenance mode on the firewall.
Why it matters
The weakness is a NULL pointer dereference. Code follows a pointer that was never set, and the process faults. Here the fault stops a service on the firewall. It does not give an attacker code execution or data access according to the advisory, but it removes availability, and repeated triggering is said to push the firewall into maintenance mode.
For an edge device, availability is the whole point. A firewall that drops out of service takes the paths behind it down too, so a high NVD score and a medium vendor score both justify a planned upgrade.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-2551 exploited in the wild?
Palo Alto Networks says it is not aware of malicious exploitation, and the record's KEV flag is false.
Sources
Last reviewed: 19 October 2026.
