A logic error in the signature verification routine causes the system to accept unauthenticated firmware update and license files. This flaw allows an attacker to supply malicious updates, potentially compromising the integrity of the device and enabling arbitrary code execution or unauthorized system control.

Stormshield Network Security SNS 5.1.4 EA, SNS 5.0.10, and SNS 4.8.20 LTSB are affected. These versions lack the necessary signature validation checks and are susceptible to the flaw.

The CVSS score of 7.8 classifies the issue as high severity. With an EPSS score of less than 1%, the current probability of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. An attacker could exploit this by delivering a forged update file if the device downloads updates from a non‑authenticated source or if automatic verification via SNS is disabled. If the device relies on third‑party update repositories or custom update channels, the risk increases.