A stored cross‑site scripting flaw exists in the Stormshield Network Security (SNS) enrollment portal. The vulnerability allows an attacker to embed malicious JavaScript during a request to create a user certificate via the captive portal. When an administrator later validates the request, the stored script runs within the administrator’s browser session, potentially exposing session cookies, credentials, or other sensitive data. The weakness is a classic input validation issue (CWE‑79).

Stormshield Network Security (SNS) products are affected. The vulnerability is present in SNS 5.1.4 EA, SNS 5.0.10, and SNS 4.8.20 LTSB.

The CVSS score of 7 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to submit a crafted request through the captive portal, which can be performed from a local or remote network when the portal is reachable. The XSS can only be triggered when an administrator reviews the validation page, meaning that exposure is limited to users with administrative access. Despite the limited trigger, an attacker who can influence the validation process could hijack administrative sessions or steal credentials.