dbcve.org
Stormshield Network SecurityApplication · Stormshield

CVE-2023-34198

HIGH · 7.3 CVSS v3.1 Published 2024-02-29
Fix available
A fix is available. Upgrade to 3.7.37 / 3.11.25 or later.
See remediation →
82/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any" type, which may have unexpected results for access control.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

In Stormshield SNS, when a Network object is created from an inactive DHCP interface in the filtering configuration, the object incorrectly defaults to ':any' (any/any) instead of maintaining its intended restricted scope. This causes the filtering rule to permit traffic that should be denied, effectively bypassing intended access controls.

MitigationUpgrade Stormshield SNS to version 3.7.37, 3.11.25, 4.3.19, 4.6.6, or 4.7.1 respectively. After upgrading, audit filtering rules that reference network objects derived from DHCP interfaces to confirm they behave as expected.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Stormshield Network SecurityApplication
Affected:>= 1.0.0, < 3.7.37>= 3.8.0, < 3.11.25>= 4.0.0, < 4.3.19>= 4.4.0, < 4.6.6= 4.7.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check Stormshield SNS version
    Access the SNS CLI and run 'version' or check via the web interface under System > Status. Compare the displayed version against the affected ranges: < 3.7.37, < 3.11.25, < 4.3.19, < 4.6.6, or exactly 4.7.0.
    Affected if The installed version falls within any of the affected version ranges.
  2. Identify network objects referencing DHCP interfaces
    In the SNS web interface, navigate to Objects > Network objects. Look for objects whose definition includes a DHCP interface reference (typically displayed as 'dhcp:<interfacename>' or similar notation).
    Affected if Any network objects are defined using a DHCP interface as their source.
  3. Verify DHCP interface status
    In the SNS web interface under Network > Interfaces, check whether the DHCP-referenced interfaces from step 2 are currently inactive, down, or not plugged in.
    Affected if Any of the DHCP interfaces used in network objects are in an inactive or down state.
  4. Inspect filtering rules using DHCP-derived objects
    In the SNS web interface under Firewall > Filtering, examine all filtering rules. Identify rules that reference the DHCP-derived network objects identified in step 2. Check the object scope in the rule configuration.
    Affected if Filtering rules reference network objects derived from DHCP interfaces, and those objects show ':any' or 'any/any' scope despite the intended restricted configuration.

A user is affected if their SNS version is vulnerable AND they have filtering rules using network objects defined on inactive DHCP interfaces, which show an unrestricted ':any' scope instead of the intended restricted scope.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 3.7.37 / 3.11.25 / 4.3.19 or later
Fixed in 3.7.373.11.254.3.19
Interim mitigation

Upgrade Stormshield SNS to version 3.7.37, 3.11.25, 4.3.19, 4.6.6, or 4.7.1 respectively. After upgrading, audit filtering rules that reference network objects derived from DHCP interfaces to confirm they behave as expected.

Recommended fix High confidence

Upgrade to 3.7.37, 3.11.25, 4.3.19, 4.6.6, or 4.7.1 (whichever is the minimum fixed release for your current branch)

  1. 1. Identify current Stormshield Network Security (SNS) version via admin web interface (Dashboard > System > General) or CLI command 'snsinfo'
  2. 2. Based on current version, determine the minimum fixed release to upgrade to: for 1.0.0-3.7.x upgrade to 3.7.37; for 3.8.0-3.11.x upgrade to 3.11.25; for 4.0.0-4.3.x upgrade to 4.3.19; for 4.4.0-4.6.x upgrade to 4.6.6; for 4.7.0 upgrade to 4.7.1
  3. 3. Download the firmware update from Stormshield customer portal or authorized distribution channel
  4. 4. Before upgrade: backup current configuration via admin interface (Configuration > Backup) or CLI command 'sns backup'
  5. 5. Apply firmware upgrade following Stormshield upgrade procedure documentation
  6. 6. After upgrade, verify: a) System reports correct new version, b) Filtering policies using Network objects from DHCP interfaces work as expected, c) No unexpected 'any' type object behavior in access control rules
  7. 7. If issues occur, restore from backup and contact Stormshield support
Caveat Firmware upgrades may include other changes; review release notes for your specific version path before applying; always backup configuration before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Stormshield Network Security Scoped from the published advisory
  • Consultation4.0 h
  • Implementation2.0 h
  • Testing6.0 h
  • Review / QA2.0 h
14.0 hours of engineering $2,420
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,872.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-34198 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-34198 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data