CVE-2024-3385 is a high severity (CVSS 7.5) flaw in the packet processing of Palo Alto Networks PAN-OS that lets a remote attacker reboot PA-5400 and PA-7000 Series hardware firewalls. Repeated attacks force maintenance mode. Read the vendor advisory for fixed versions and upgrade.
What's affected
The record says a packet processing mechanism in PAN-OS lets a remote attacker reboot hardware based firewalls, and that repeated attacks eventually put the firewall into maintenance mode, which needs manual intervention to bring it back online. The record lists the affected models as the PA-5400 Series and the PA-7000 Series. The NVD configuration data also names the PA-5410 model.
The weaknesses are CWE-20, improper input validation, and CWE-476, null pointer dereference. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H: network reachable, low complexity, no account and no user interaction, with a high impact on availability only. That gives 7.5.
The only reference is the Palo Alto Networks advisory for this CVE. I could not load it in this review, because the fetch tool was unavailable at that point, so I cannot state the fixed PAN-OS versions or any workaround, and I will not guess them. The sibling advisories published the same day, CVE-2024-3382, CVE-2024-3383 and CVE-2024-3384, report vendor scores higher than the NVD scores. The advisory for this one may do the same, so read it and note both numbers if they differ. The record does not mark it as exploited in the wild and it is not in the CISA KEV list.
How to check if you're exposed
- Confirm the hardware model. The record lists the PA-5400 Series and PA-7000 Series.
- Read the PAN-OS version with
show system infoin the CLI, or from the dashboard. - Open the advisory and compare your version with its affected and fixed ranges for your branch.
- If you run VM Series, Cloud NGFW or Prisma Access, check the advisory for whether they are in scope. The record speaks of hardware based firewalls.
What to do now
- List all PA-5400 and PA-7000 devices and their PAN-OS versions.
- Read the vendor advisory for the fixed releases and any workaround.
- Schedule an upgrade through change control, and upgrade one member of each high availability pair at a time.
- Watch device logs for unexpected restarts and for the device entering maintenance mode.
- Make sure you have out of band console access to these firewalls, since recovery from maintenance mode needs manual action.
- Record the advisory and your fixed version in your vulnerability tracker.
Why it matters
Two weakness classes meet here. The packet handling code does not validate something it should, and a null pointer is then used, which crashes the process and reboots the device. The record says repeated triggering leads to maintenance mode. That moves the failure from a short outage to one that needs a person with console access.
An edge firewall that reboots on demand gives anyone who can send it traffic a way to cut the network off. No account is needed, so exposure follows the reach of the device, not the strength of passwords. Treat the upgrade as a priority for any device with traffic from untrusted networks.
Quick check
Which PAN-OS version fixes CVE-2024-3385?
The record does not say and I could not load the advisory. Read the Palo Alto Networks advisory for the fixed releases on your branch.
Which devices are affected?
The record lists the PA-5400 Series and PA-7000 Series hardware firewalls.
Sources
Last reviewed: 19 October 2026.
