Read the docs

StoneFly

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

StoneFly records in CISA KEV

No StoneFly vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Storage Concentrator 1 record LOW

Records

6 records

TI-2026-40773 CVE-2026-56415 · GHSA-p9rg-4wjx-jm87

OS Command Injection in StoneFly Storage Concentrator

Priority MEDIUM 56

Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.0436 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-78
TI-2026-40771 CVE-2026-56413 · GHSA-h267-8j5j-27gj

OS Command Injection in StoneFly Storage Concentrator

Priority MEDIUM 56

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.04194 Published 2026-06-30 Fixed in 8.0.4.29 CWE-78
TI-2026-40222 CVE-2026-55721 · GHSA-864f-9wr6-7qwp

SQL Injection in StoneFly Storage Concentrator

Priority MEDIUM 46

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00546 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-89
TI-2026-36893 CVE-2026-50110 · GHSA-7x9m-9r4j-r94f

Use of Hard-coded Credentials in StoneFly Storage Concentrator

Priority MEDIUM 41

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file.

CVSS 4.0CRITICAL 9.3 Local No auth No interaction EPSS 0.00175 Published 2026-06-30 Fixed in 8.0.4.26, 8.0.4.29 CWE-798
TI-2026-36861 CVE-2026-50040 · GHSA-8h25-3425-5fgh

Cross-site Scripting in StoneFly Storage Concentrator

Priority LOW 23

Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00327 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-79
Open these records in search →