CVE-2021-45885
📋 TL;DR
This vulnerability in Stormshield Network Security (SNS) allows attackers to potentially access SSH accounts using old passwords that weren't properly cleared during password changes. It affects organizations running SNS firewalls between versions 4.2.2 and 4.2.7 during specific update-migration scenarios.
💻 Affected Systems
- Stormshield Network Security (SNS)
📦 What is this software?
Network Security by Stormshield
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent SSH access to firewall management interfaces, potentially compromising network security controls and enabling lateral movement.
Likely Case
Unauthorized SSH access to firewall management, allowing configuration changes, rule modifications, or credential harvesting.
If Mitigated
Limited impact due to network segmentation, strong authentication controls, and monitoring of SSH access patterns.
🎯 Exploit Status
Requires knowledge of old SSH passwords and access to SSH interface. Specific migration scenario needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.8
Vendor Advisory: https://advisories.stormshield.eu/2021-069/
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download SNS 4.2.8 from Stormshield portal. 3. Apply update via web interface or CLI. 4. Restart firewall. 5. Verify SSH password changes work correctly.
🔧 Temporary Workarounds
Force SSH password reset
allManually reset SSH passwords for all accounts to ensure old credentials are cleared
ssh admin@firewall_ip
passwd
Enter new password twice
Disable SSH access
allTemporarily disable SSH management if not required
Configure via web interface: Administration > Access > SSH > Disable
🧯 If You Can't Patch
- Implement network segmentation to restrict SSH access to management networks only
- Enable multi-factor authentication for SSH access and monitor SSH login attempts
🔍 How to Verify
Check if Vulnerable:
Check SNS version via web interface (Dashboard > System Information) or CLI command 'show version'Check Version:
show version | grep VersionVerify Fix Applied:
After updating to 4.2.8, change SSH password and verify old password no longer works📡 Detection & Monitoring
Log Indicators:
- Failed SSH login attempts with old passwords
- Multiple SSH password change events
- Unusual SSH access patterns
Network Indicators:
- SSH connections from unexpected sources
- SSH brute force attempts
SIEM Query:
source="stormshield" AND (event="ssh_failed" OR event="password_change")