CVE-2025-27829: Uncontrolled Resource Consumption

An issue was discovered in Stormshield Network Security SNS 4.3.x before 4.3.35. If multicast streams are enabled on different interfaces, it may be possible to interrupt multicast traffic on some of these interfaces. That could result in a denial of the multicast routing service on the firewall...

CVE-2024-37386: Improper Access Control

An issue was discovered in Stormshield Network Security SNS 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations allow restarting in single-user mode despite the activation of secure boot. The following versions fix this: 4.3.27, 4.7.6, and 4.8.2...

CVE-2024-31946: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Stormshield Network Security SNS 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 through 4.7.4. A user who has access to the SNS with write access on the email alerts page has the ability to create alert email containing malicious JavaScript,...

CVE-2023-28616: Cleartext Transmission of Sensitive Information

An issue was discovered in Stormshield Network Security SNS before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends...

CVE-2023-47091: Buffer Copy without Checking Size of Input

An issue was discovered in Stormshield Network Security SNS SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible...

CVE-2023-41165: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Stormshield Network Security SNS 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer wi...

CVE-2023-47093: Undefined Security Weakness

An issue was discovered in Stormshield Network Security SNS 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a crash of the ASQ engine...

CVE-2023-26095: Improper Input Validation

ASQ in Stormshield Network Security SNS 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet...

CVE-2021-27932: Undefined Security Weakness

Stormshield Network Security SNS VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions...

PT-2023-12124

Name of the Vulnerable Software and Affected Versions Stormshield Network Security SNS VPN SSL Client versions 2.1.0 through 2.8.0 Description The issue is related to Insecure Permissions in the Stormshield Network Security SNS VPN SSL Client. No information is provided about the estimated number...

CVE-2022-30279: NULL Pointer Dereference

An issue was discovered in Stormshield Network Security SNS 4.3.x before 4.3.8. The event logging of the ASQ sofbus lacbus plugin triggers the dereferencing of a NULL pointer, leading to a crash of SNS. An attacker could exploit this vulnerability via forged sofbus lacbus traffic to cause a...

PT-2022-10308

Name of the Vulnerable Software and Affected Versions Stormshield Network Security SNS versions 3.x Description The issue is related to an Integer Overflow in the high-availability component. Recommendations For Stormshield Network Security SNS versions 3.x, at the moment, there is no information...

CVE-2021-37613: Undefined Security Weakness

Stormshield Network Security SNS 1.0.0 through 4.2.3 allows a Denial of Service...

CVE-2021-3398: Integer Overflow or Wraparound

Stormshield Network Security SNS 3.x has an Integer Overflow in the high-availability component...

PT-2022-10659

Name of the Vulnerable Software and Affected Versions Stormshield Network Security SNS versions 1.0.0 through 4.2.3 Description The issue allows for a Denial of Service. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where...

CVE-2021-31617: Improper Restriction of Operations within the Bounds of a Memory Buffer

In ASQ in Stormshield Network Security SNS 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0 through 3.11.8, and 4.0.1 through 4.2.2, mishandling of memory management can lead to remote code execution...

CVE-2021-28962: Undefined Security Weakness

Stormshield Network Security SNS before 4.2.2 allows a read-only administrator to gain privileges via CLI commands...

CVE-2021-45885: Insufficient Session Expiration

An issue was discovered in Stormshield Network Security SNS 4.2.2 through 4.2.7 fixed in 4.2.8. Under a specific update-migration scenario, the first SSH password change does not properly clear the old password...