Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: StoneFly Clear all filters
TI-2026-36893 CVE-2026-50110 · GHSA-7x9m-9r4j-r94f

Use of Hard-coded Credentials in StoneFly Storage Concentrator

Priority MEDIUM 41

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file.

CVSS 4.0CRITICAL 9.3 Local No auth No interaction EPSS 0.00175 Published 2026-06-30 Fixed in 8.0.4.26, 8.0.4.29 CWE-798
TI-2026-40771 CVE-2026-56413 · GHSA-h267-8j5j-27gj

OS Command Injection in StoneFly Storage Concentrator

Priority MEDIUM 56

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.04194 Published 2026-06-30 Fixed in 8.0.4.29 CWE-78
TI-2026-40773 CVE-2026-56415 · GHSA-p9rg-4wjx-jm87

OS Command Injection in StoneFly Storage Concentrator

Priority MEDIUM 56

Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.0436 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-78
TI-2026-40222 CVE-2026-55721 · GHSA-864f-9wr6-7qwp

SQL Injection in StoneFly Storage Concentrator

Priority MEDIUM 46

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00546 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-89
TI-2026-36861 CVE-2026-50040 · GHSA-8h25-3425-5fgh

Cross-site Scripting in StoneFly Storage Concentrator

Priority LOW 23

Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00327 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-79