The flaw permits a reflected XSS attack on the login API of Stormshield SNS appliances. An attacker can inject arbitrary script that runs in the victim’s browser, enabling theft of session cookies or malicious redirects. This client‑side attack compromises confidentiality of session data and can alter user interactions, and is identified as a classic reflected XSS (CWE‑79).

Versions 4.3.0 to 4.3.41, 4.8.0 to 4.8.15, and 5.0.0 to 5.0.5 of Stormshield SNS are vulnerable. The vendor’s fix is included in SNS 4.3.42, 4.8.16, and 5.0.6.

The CVSS base score of 5.3 denotes moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires the victim to access the login API, typically via a phishing or social engineering vector, so the potential impact is significant but the likelihood is moderate. Once the injected script executes, the attacker can exfiltrate cookies and data or perform drive‑by conversions.