How can I see if my FW has already been exploited by the CVE-2024-3400?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

How can I see if my FW has already been exploited by the CVE-2024-3400?

L4 Transporter

Hello team

How can we determine if your device logs match the known indicators of compromise (IoC) for this vulnerability?

I have already fixed the vulnerability and I have the TSF of my device and I want to see if I have been exploited before applying the WK,

Can anyone help me?



L0 Member

CVE has been updated with the instructions to do that:

L0 Member

Hi All


Do these investigations have to be done running on the vulnerable software version, or is it still possible to check this after the software upgrade to a fixed release? 

L4 Transporter

I worked with our team but not discussed this with Palo but my understanding is the logs should still show the information even after an upgrade. We just pushed the 10.2.9-h1 release out this morning after Palo changed their guidance regarding telemetry not being enough to stop this. We have the signatures but who knows what else they'll discover later that isn't mitigated without an upgrade.

L4 Transporter

 I should mention that we are collecting logs via Panorama and externally. I just read in another post and hadn't noticed this in the write up that the vulnerability supposedly erases log entries...not sure how Palo is then analyzing logs in tech support files if the logs don't show the activity after the fact.

  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!