CVE-2024-3384

Description

A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.

Overview

State: PUBLISHED
Assigner (CNA): palo_alto
CVSS severity: HIGH
CVSS score: 7.5 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Effective score: 7.5 / 10 HIGH source: CNA overview
CWE(s): CWE-1286
Reserved: 2024-04-05
Published: 2024-04-10 17:06 UTC
Last updated: 2024-08-01 20:12 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3384.json
Linked Threat: CVE-2024-3384 — PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2024-04-10 17:15:57 UTC
NVD last modified: 2025-01-24 15:54:56 UTC
NVD CVSS v3.1: 7.5 / 10 HIGH source: psirt@paloaltonetworks.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability subscore: 3.9 / 10
Impact subscore: 3.6 / 10
EPSS score: 0.0073 (probability of exploitation in next 30 days)
EPSS percentile: 72.88% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2024-31973
Assigner: palo_alto
Published: Apr 10, 2024, 5:06:21 PM
Updated: Aug 1, 2024, 8:12:06 PM
EUVD base score (CVSS 3.1): 7.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EUVD-reported EPSS: 0.7300
Vendors: Palo Alto Networks
Products: PAN-OS (8.1.0 <8.1.24)

PAN-OS (10.0.0 <10.0.12)

PAN-OS (9.1.0 <9.1.15-h1)

PAN-OS

Prisma Access

PAN-OS (9.0.0 <9.0.17)

Cloud NGFW
Aliases: GHSA-hwc4-2rmw-hcvq

ENISA description: A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.

EUVD references (1)

https://security.paloaltonetworks.com/CVE-2024-3384

Affected products (3)

Vendor	Product	Versions	Platforms
Palo Alto Networks	PAN-OS	`8.1.0` (affected), `9.0.0` (affected), `9.1.0` (affected), `10.0.0` (affected), `10.1.0` (unaffected), `10.2.0` (unaffected), `11.0.0` (unaffected), `11.1.0` (unaffected)	—
Palo Alto Networks	Cloud NGFW	`All` (unaffected)	—
Palo Alto Networks	Prisma Access	`All` (unaffected)	—

Affected products — CPE 2.3 (2) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:9.1.15:-:*:*:*:*:*:*

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://security.paloaltonetworks.com/CVE-2024-3384

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/1286.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2024-3384 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-31973 rapid7:euvd.enisa.europa.eu
https://security.paloaltonetworks.com/CVE-2024-3384 rapid7:security.paloaltonetworks.com
https://www.cve.org/CVERecord?id=CVE-2024-3384 rapid7:www.cve.org

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://security.paloaltonetworks.com/CVE-2024-3384 psirt@paloaltonetworks.com Vendor Advisory
https://security.paloaltonetworks.com/CVE-2024-3384 af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2024-3384`	no local data	2026-05-14 09:34 UTC

Remediations (8)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Critical Microsoft Vulnerabilities Patched December 2024 | Qualys

web:blog.qualys.com

Review Microsoft and Adobe's December 2024 Patch Tuesday updates, addressing critical vulnerabilities and key fixes for enhanced security protection.

2026-05-17 13:56 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-05-17 13:56 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-17 13:56 UTC
KB5089900 - Description of the security update for SQL Server 2022 CU24 ...

web:support.microsoft.com

Summary Improvements and fixes included in this update How to obtain and install the update How to obtain or download the latest cumulative update package for Linux More information File information Information about protection and security Summary This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories ...

2026-05-17 13:56 UTC
Release notes for Hotpatch on Windows 11 Enterprise version 25H2

web:support.microsoft.com

Hotpatch for Windows 11 Enterprise, version 25H2 gives organizations the ability to apply security updates without requiring a device restart. This helps maintain security while keeping workflows uninterrupted. Hotpatch is an extension of Windows Update and requires Autopatch to create and deploy updates to devices enrolled in the Autopatch quality update policy. Benefits include: Immediate ...

2026-05-17 13:56 UTC
Microsoft's new AI system finds 16 Windows flaws, including four ...

web:www.csoonline.com

Microsoft has unveiled a new AI-driven vulnerability discovery system that identified 16 previously unknown Windows vulnerabilities, including four critical remote code execution flaws, in what ...

2026-05-17 13:56 UTC
Microsoft Technical Security Notifications

web:www.microsoft.com

Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

2026-05-17 13:56 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-17 13:56 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2024-3384.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-12T15:54:19.998958Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:32:38.411Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:12:06.484Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2024-3384"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "8.1.24",
                  "status": "unaffected"
                }
              ],
              "lessThan": "8.1.24",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "9.0.17",
                  "status": "unaffected"
                }
              ],
              "lessThan": "9.0.17",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "9.1.15-h1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "9.1.15-h1",
              "status": "affected",
              "version": "9.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "10.0.12",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.0.12",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.1.0"
            },
            {
              "status": "unaffected",
              "version": "10.2.0"
            },
            {
              "status": "unaffected",
              "version": "11.0.0"
            },
            {
              "status": "unaffected",
              "version": "11.1.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cloud NGFW",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Prisma Access",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue affects only PAN-OS configurations with NTLM authentication enabled. You should verify whether NTLM authentication is enabled by checking your firewall web interface (Device > User Identification > User Mapping > Palo Alto Networks User-ID Agent Setup > NTLM)."
            }
          ],
          "value": "This issue affects only PAN-OS configurations with NTLM authentication enabled. You should verify whether NTLM authentication is enabled by checking your firewall web interface (Device > User Identification > User Mapping > Palo Alto Networks User-ID Agent Setup > NTLM)."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Palo Alto Networks thanks rqu for discovering and reporting this issue."
        }
      ],
      "datePublic": "2024-04-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online."
            }
          ],
          "value": "A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.<br>"
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1286",
              "description": "CWE-1286 Improper Validation of Syntactic Correctness of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-10T17:06:21.704Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "url": "https://security.paloaltonetworks.com/CVE-2024-3384"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.15-h1, PAN-OS 10.0.12, and all later PAN-OS versions.<br>"
            }
          ],
          "value": "This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.15-h1, PAN-OS 10.0.12, and all later PAN-OS versions.\n"
        }
      ],
      "source": {
        "defect": [
          "PAN-198992"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-10T16:00:00.000Z",
          "value": "Initial publication"
        }
      ],
      "title": "PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2024-3384",
    "datePublished": "2024-04-10T17:06:21.704Z",
    "dateReserved": "2024-04-05T17:40:17.390Z",
    "dateUpdated": "2024-08-01T20:12:06.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}