{"id":"CVE-2026-113469","kind":"vulnerability","aliases":["CVE-2026-113469"],"related":[],"title":"SNS: dynamic data signature check accepts unauthenticated updates during autoupdate","description":"A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.","summary":"Stormshield Network Security (SNS) firewalls accept unauthenticated dynamic data update files during Autoupdate because of a logic error in signature verification. An attacker positioned on the network path to the update server (adjacent, high complexity) could get unverified data installed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Stormshield Network Security","fixed":["4.3.45 QS","4.8.20 LTSB","5.0.10","5.1.4 EA"],"affected":"4.3.0-4.3.44, 4.8.0-4.8.19, 5.0.0-5.0.9, 5.1.0-5.1.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["autoupdate","firewall","infrastructure","network-appliance","sns","stormshield"],"not_affected_if":["https-official-update-servers","patched-version"],"how_to_check":"On the firewall, check the SNS firmware version (web admin dashboard or System > Maintenance). Exposed if running 5.1.0-5.1.3, 5.0.0-5.0.9, 4.8.0-4.8.19 or 4.3.0-4.3.44. Also check whether Autoupdate uses custom update servers or plain HTTP.","fix":"Upgrade to SNS 5.1.4 EA, 5.0.10, 4.8.20 LTSB or 4.3.45 QS. Until then use only official Stormshield update servers or SMC mirrors with HTTPS enabled; for custom update servers, enable HTTPS and verify SHA-256 hashes of hosted files against the official servers.","status":"resolved","published_at":"2026-10-20T09:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:22:48+00:00","updated_at":"2026-10-25T03:37:02+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T03:22:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SNS: dynamic data signature check accepts unauthenticated updates during autoupdate","impact":"high","summary":"A logic error in the SNS signature verification routine lets it accept dynamic data files that were never authenticated. An attacker who can deliver a crafted update during the autoupdate routine can get unverified data installed on the device.","category":"infrastructure","nicknames":[],"who_cares":["sns","autoupdate"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unauthenticated data update accepted and installed by the device","analyst_note":"Identify the vendor and product behind 'SNS' and its autoupdate channel, and confirm affected versions and the patched release from the NVD entry or vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000503,"input_tokens":3268,"output_tokens":353,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and product behind 'SNS' and its autoupdate channel, and confirm affected versions and the patched release from the NVD entry or vendor advisory.","search":"'-113469':13A,16A '-2026':12A,15A 'accept':6A,33B,92C 'adjac':60B 'applianc':25B 'attack':50B 'autoupd':10A,20B,40B,99C 'check':5A,81C 'complex':62B 'could':63B 'cve':11A,14A 'data':3A,36B,66B,78C,96C 'dynam':2A,35B,77C,95C 'error':45B,84C 'failur':69C 'file':38B,79C 'firewal':21B,32B 'get':64B 'high':61B 'identifi':72C 'infrastructur':22B 'instal':67B 'logic':44B,83C 'network':18A,24B,29B,54B 'network-appli':23B 'path':55B 'posit':51B 'result':90C 'routin':89C,100C 'secur':30B 'security':19A 'server':59B 'signatur':4A,47B,80C,87C 'sns':1A,26B,31B,75C 'stormshield':17A,27B,28B 'unauthent':7A,34B,94C 'unverifi':65B 'updat':8A,37B,58B,97C 'verif':48B,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-25T03:37:02Z","by":"analyst","run_id":755},"products":{"at":"2026-10-25T03:37:02Z","by":"analyst","run_id":755},"workarounds":{"at":"2026-10-25T03:37:02Z","by":"analyst","run_id":755}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cert@airbus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113469","severity":null,"published_at":"2026-10-20T09:17:09+00:00","modified_at":"2026-10-20T19:35:23+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113469:755","url":null,"severity":null,"published_at":"2026-10-25T03:37:02+00:00","modified_at":"2026-10-25T03:37:02+00:00","first_seen_at":"2026-10-25T03:37:02+00:00","fetched_at":"2026-10-25T03:37:02+00:00","note":"SNS = Stormshield Network Security (firewall). Stormshield STORM-2026-032 v2 read: affected/fixed versions, workaround. Vendor rates medium, CNA CVSS 7.5 (adjacent, high complexity); temporal marks PoC maturity but no public PoC link found; no exploitation reported. Not searched social."}],"documents":[{"id":3247,"url":"https://advisories.stormshield.eu/2026-032/","title":"Stormshield STORM-2026-032: Improper Signature Verification of Active Update Files","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3249,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113469","title":"NVD CVE-2026-113469","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}