Stormshield Network Security EUVD-2026-104828

Exploitation requires that update files or licenses are retrieved from a source OTHER than the official MyStormshield servers, OR that automatic verification via SNS is not used - these are the exact conditions the vendor advises against. The concrete prerequisite is an administrator obtaining a forged update/license from an untrusted channel and applying it to the SNS appliance (AV:L, UI:R). Limiting factors that reduce real-world risk: the attack is local with required user interaction (an operator must actively install the file), it does not work when the documented MyStormshield-only sourcing or SNS automatic verification is in use, and it depends on the administrator trusting an attacker-supplied file. Default use of MyStormshield servers with automatic verification effectively neutralizes the flaw.

This is a CWE-287 authentication bypass in the signature verification routine of Stormshield Network Security (SNS), where a logic error causes the system to accept unsigned/unauthenticated update and license files. The provided CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent and signals a serious integrity/availability impact: full compromise of the appliance if a forged update is accepted. However, several real-world risk dampeners are present. The attack vector is LOCAL (AV:L) and requires user interaction (UI:R) - meaning an operator must actively retrieve and apply a malicious update or license file rather than an attacker exploiting it remotely and unaided. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is gated behind an unusual precondition: the administrator must source update/license files from somewhere other than the official MyStormshield servers (or disable automatic verification via SNS). CONFLICT TO NOTE: the description characterizes the flaw as acceptance of 'unauthenticated' files and the vector sets PR:N, yet the realistic exploitation path requires a privileged operator action (applying firmware/licenses to a security appliance) and UI:R - so the unauthenticated framing applies to the file's signature, not to attacker access. Overall this is a genuine integrity defect worth patching on an edge security device, but it is a targeted/operator-dependent issue rather than a mass-exploitable remote threat.

An attacker crafts a malicious SNS firmware update or license file and delivers it to an administrator through an untrusted channel (e.g., a mirror, man-in-the-middle on a non-MyStormshield download, or social engineering). Because the signature verification logic is flawed, the appliance accepts the forged, unsigned file as legitimate when the operator applies it, leading to full compromise of the firewall. No public POC is present in the provided data.