CVE-2026-111090 PUBLISHED

Improper Signature Verification of Firmware Update Files

Assigner: airbus
Reserved: 15.10.2026 Published: 20.10.2026 Updated: 20.10.2026

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Stormshield
Product	Stormshield Network Security
Versions	Default: unknown affected from 4.3.0 to 4.3.44 (incl.) affected from 4.8.0 to 4.8.19 (incl.) affected from 5.0.0 to 5.0.9 (incl.) affected from 5.1.0 to 5.1.3 (incl.) Version 4.8.20 LTSB is unaffected Version 5.0.10 is unaffected Version 5.1.4 EA is unaffected

Workarounds

If applicable, verify the SHA-256 hash of each update file. The reference hashes are available in the MyStormshield portal

Solutions

The following updates will fix this vulnerability:

SNS 5.1.4 EA

SNS 5.0.10

SNS 4.8.20 LTSB

References

https://advisories.stormshield.eu/2026-031/

Problem Types

CWE-287: Improper Authentication CWE