CVE-2026-55721criticalCWE-89

CVE-2026-55721: fallo crítico en StoneFly Storage Concentrator

SQL Injection in StoneFly Storage Concentrator

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Storage Concentrator+ Monitorear Storage Concentrator Virtual Machine

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.2epss 0.5%
Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Productos afectados
StoneFly · Storage ConcentratorStoneFly · Storage Concentrator Virtual Machine
CVEs relacionadas — StoneFly Storage Concentrator

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-56413CRITICALOS Command Injection in StoneFly Storage ConcentratorEPSS 4.2%CVE-2026-50040MEDIUMCross-site Scripting in StoneFly Storage ConcentratorEPSS 0.3%CVE-2026-50110CRITICALUse of Hard-coded Credentials in StoneFly Storage ConcentratorEPSS 0.2%