GCVE - cpe:2.3:a:stonefly:storage_concentrator:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:stonefly:storage_concentrator:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Stonefly (`13042936-fb31-59a7-b442-174f149fc0be`)
Product	Storage Concentrator (`65efe61d-301f-59d8-967e-b68d328f7b86`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-56415`	vulnerable	2026-07-29 01:00:29.156220	OS Command Injection in StoneFly Storage Concentrator CRITICAL (10) Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges on the underlying system. Published: 2026-06-30T22:40:55.582Z Updated: 2026-07-01T12:42:03.699Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json https://stonefly.com/contact-us/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-56413`	vulnerable	2026-07-29 01:00:29.155036	OS Command Injection in StoneFly Storage Concentrator CRITICAL (10) Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges. Published: 2026-06-30T22:50:58.131Z Updated: 2026-07-01T12:41:07.971Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json https://stonefly.com/contact-us/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-50110`	vulnerable	2026-07-29 00:57:47.564823	Use of Hard-coded Credentials in StoneFly Storage Concentrator CRITICAL (9.2) Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems. Published: 2026-06-30T22:54:42.362Z Updated: 2026-07-01T12:40:24.035Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json https://stonefly.com/contact-us/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-31947`	vulnerable	2026-06-08 06:35:32.449567	Details available StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by authenticated users. Using a crafted path parameter with the Online Help facility can expose sensitive system information. Published: 2024-07-12T00:00:00.000Z Updated: 2025-03-14T15:00:18.796Z Open on db.gcve.eu Reference links https://stonefly.com https://stonefly.com/security-advisories/cve-2024-31947/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.