EUVD-2026-41271
GHSA-wcc8-vcvw-p9m3
Severity by source
AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
SSH management-plane access is adjacent (AV:A); high privilege required to reach CLI (PR:H); admin must issue the exposing command (UI:R); only confidentiality impacted via secret leakage (C:H/I:N/A:N).
Primary rating from Vendor (airbus).
CVSS VectorVendor: airbus
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included)
There is a possible leak of secret information if administration commands have been passed with the CLI command line tool.
Someone with SSH access to the firewall (if SSH multiuser mode is enabled) could possibly get the proxy CA passphrase or TPM password.
AnalysisAI
Secret credential leakage in StormShield Network Security's CLI tool exposes the proxy CA passphrase or TPM password to other users sharing an SSH session on the firewall appliance. Affected versions span three distinct branches - 4.3.0-4.3.41, 4.8.0-4.8.15, and 5.0.0-5.0.5 - and exploitation is gated behind SSH multiuser mode being explicitly enabled. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, though the leaked secrets carry high downstream value for privilege escalation or certificate authority abuse.
Technical ContextAI
StormShield Network Security (SNS) is a firewall and UTM appliance platform (CPE: cpe:2.3:a:stormshield:stormshield_network_security). The flaw is classified as CWE-532 (Insertion of Sensitive Information into Log File / Observable Output), meaning sensitive values - specifically the proxy CA passphrase or TPM (Trusted Platform Module) password - are written into CLI command output, shell history, process argument lists, or logs that are accessible to co-resident SSH users when administration commands are executed. The TPM password protects hardware-secured cryptographic key storage, while the proxy CA passphrase protects the certificate authority used for SSL/TLS inspection. Disclosure of either secret can enable decryption of intercepted traffic, forged certificates, or persistent privileged access to protected resources beyond the firewall itself. The adjacent-network vector (AV:A) in the CVSS string is consistent with SSH being a management-plane protocol typically reachable only from a restricted administrative network segment.
RemediationAI
Consult the Stormshield advisory at https://advisories.stormshield.eu/2025-007/ for confirmed patched versions and upgrade instructions - exact fixed release numbers are not independently confirmed in the available data beyond the advisory reference itself. As an immediate compensating control, disable SSH multiuser mode if it is not operationally required, since the vulnerability is only exploitable when this feature is active; disabling it eliminates the attack surface entirely without patching. Where SSH multiuser mode is operationally necessary, restrict SSH access to the absolute minimum number of trusted administrative accounts, enforce key-based authentication, and audit current SSH access grants. Organizations should treat the proxy CA passphrase and TPM password as potentially compromised and rotate them - note that rotating the TPM password may require device re-provisioning steps specific to the SNS platform and could affect encrypted key storage; coordinate with Stormshield support before rotating. Review CLI command history and accessible log files on affected appliances for evidence of unauthorized observation.
More in Stormshield Network Security
View allzlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control packet
The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication m
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ p
An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. Rated high severity (CVSS 7.5), this vulnera
An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x
An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through
ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a cr
strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a craft
Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific for
An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.8. Rated high severity (CVSS 7.5), this v
In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x b
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today