CVE-2023-34198
CVE-2023-34198 is a high-severity vulnerability in Stormshield Stormshield Network Security with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.3)
- EPSS exploit prediction: 1% (40th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Stormshield Stormshield Network Security
- Published:
- Last modified:
Description
In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any" type, which may have unexpected results for access control.
Frequently asked questions
- What is CVE-2023-34198?
- In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any" type, which may have unexpected results for access control.
- How severe is CVE-2023-34198?
- CVE-2023-34198 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
- Is CVE-2023-34198 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-34198?
- CVE-2023-34198 primarily affects Stormshield Stormshield Network Security. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2023-34198?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2023-34198 published?
- CVE-2023-34198 was published on 2024-02-29 and last updated on 2026-06-17.
References
Affected products (2)
- cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*
- cpe:2.3:a:stormshield:stormshield_network_security:4.7.0:*:*:*:*:*:*:*
More vulnerabilities in Stormshield Stormshield Network Security
- CVE-2023-20032 — Critical (CVSS 9.8): On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the…
- CVE-2022-37434 — Critical (CVSS 9.8): zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip…
- CVE-2021-31617 — Critical (CVSS 9.8): In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0…
- CVE-2020-7465 — Critical (CVSS 9.8): The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control…
- CVE-2018-20850 — High (CVSS 8.2): Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of…
- CVE-2025-48707 — High (CVSS 7.5): An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in…
All CVEs affecting Stormshield Stormshield Network Security →