The vulnerability is a stored Cross‑Site Scripting (CWE‑79) in the SNS VPN log monitoring screen. Attackers can inject malicious script that will be persisted and executed each time a user opens the logs view. This allows client‑side code execution, which can hijack user sessions, steal credentials, or deface the interface, thereby compromising the confidentiality and integrity of user data.

The affected product is Stormshield Network Security from Stormshield. The vulnerability applies to all versions of the VPN log monitoring component, although specific version information was not supplied in the advisory.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown, but the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the web‑based VPN logs interface; an authenticated or privileged user may need to input malicious content that is stored. Because the payload is stored, an attacker who gains write access to the log monitoring input can later execute the code by any user viewing the logs. The lack of a KEV listing suggests that active exploitation has not been observed, but the moderate CVSS and the nature of XSS still warrant attention.