Read the docs
TI-2026-40771 Aliases CVE-2026-56413GHSA-h267-8j5j-27gj

OS Command Injection in StoneFly Storage Concentrator

Priority MEDIUM 56CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04194 91st percentileScored 2026-11-07
Fix Fixed Storage Concentrator (StoneFly): 8.0.4.29Storage Concentrator Virtual Machine (StoneFly): 8.0.4.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
StoneFlyStorage Concentratorbefore 8.0.4.298.0.4.29Patch availableCNA
StoneFlyStorage Concentrator Virtual Machinebefore 8.0.4.298.0.4.29Patch availableCNA
  • Storage Concentrator VendorStoneFly Affected before 8.0.4.29 Fixed in 8.0.4.29 Patch available CNA
  • Storage Concentrator Virtual Machine VendorStoneFly Affected before 8.0.4.29 Fixed in 8.0.4.29 Patch available CNA

Remediation

  • Fix · CNA Storage Concentrator (StoneFly) Fixed in 8.0.4.29
  • Fix · CNA Storage Concentrator Virtual Machine (StoneFly) Fixed in 8.0.4.29

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56413
  2. 2026-10-03 Alias added: GHSA-h267-8j5j-27gj

References

Other 3

  • TI-2026-40773 OS Command Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 10.0
  • TI-2026-40222 SQL Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 9.2
  • TI-2026-36893 Use of Hard-coded Credentials in StoneFly Storage Concentrator CVSS 4.0CRITICAL 9.3
  • TI-2024-21049 StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by… CVSS 3.1MEDIUM 6.5
  • TI-2026-36861 Cross-site Scripting in StoneFly Storage Concentrator CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences