Palo Alto Networks has recently confirmed that certain models of their next-generation firewalls, which operate on the PAN-OS system, are experiencing spontaneous reboots. The company acknowledged that a unique issue within specific older versions of PAN-OS could lead to system crashes under particular traffic conditions. This problem is resolved in hotfix 11.1.4-h12, which was made available in a limited release on January 31.
The affected devices run on versions 11.1.4-h7 or h9 of the operating system. Palo Alto Networks is currently testing another unrelated fix, hotfix 11.1.4-h13, aiming for a general update release by February 20 or earlier to ensure all systems are fully optimized and secure.
Despite the issue being classified as affecting a "very small number" of customers, the company advised those experiencing problems to contact their support for access to the hotfix. However, the company did not provide detailed explanations about when the issue arose or the reason for the limited availability of the hotfix. Concerns over security have prevented the company from sharing specifics about the root cause of the reboots.
Reports of the issue surfaced as customers began voicing their complaints on platforms like Reddit, with some users noting multiple unexpected reboots from their firewalls in recent months. One user suggested that the issue might be linked to configurations involving SSL interception.
Experts like Johannes Ullrich from the SANS Institute speculated that the issue is likely a bug rather than a result of a cyber attack, suggesting that potential low system resources or specific packet triggers could lead to these reboot events.
In related news, researchers have also pointed out the presence of long-standing vulnerabilities in the UEFI firmware of Palo Alto Networks firewalls, indicating that these known issues could allow for malware injection into the low-level firmware if exploited by attackers with root access.
