CVE-2023-41166: Stormshield Network Security

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1. It's possible to know if a specific user account exists on the SNS firewall by using remote access commands.

Affected products

• Stormshield Stormshield Network Security: from 3.7.0, up to and including 3.7.39; from 3.11.0, up to and including 3.11.27; from 4.3.0, before 4.3.23 (fixed in 4.3.23); from 4.6.0, before 4.6.10 (fixed in 4.6.10); from 4.7.0, before 4.7.2 (fixed in 4.7.2)

Published 2023-12-21. Last modified 2026-06-17.