CVE-2023-41166

published 2023-12-21

CVE-2023-41166: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and…

Priority P4 29 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1. It's possible to know if a specific user account exists on the SNS firewall by using remote access commands.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
stormshield	stormshield_network_security	3.11.0 – 3.11.27	—
stormshield	stormshield_network_security	3.7.0 – 3.7.39	—
stormshield	stormshield_network_security	>= 4.3.0 < 4.3.23	4.3.23
stormshield	stormshield_network_security	>= 4.6.0 < 4.6.10	4.6.10
stormshield	stormshield_network_security	>= 4.7.0 < 4.7.2	4.7.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.