CVE-2026-56413criticalCWE-78

CVE-2026-56413: falha crítica em StoneFly Storage Concentrator

OS Command Injection in StoneFly Storage Concentrator

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Storage Concentrator+ Monitorar Storage Concentrator Virtual Machine

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 4.2%
Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
Produtos afetados
StoneFly · Storage ConcentratorStoneFly · Storage Concentrator Virtual Machine
CVEs relacionadas — StoneFly Storage Concentrator

No mesmo produto, das mais perigosas para as menos.

CVE-2026-55721CRITICALSQL Injection in StoneFly Storage ConcentratorEPSS 0.5%CVE-2026-50040MEDIUMCross-site Scripting in StoneFly Storage ConcentratorEPSS 0.3%CVE-2026-50110CRITICALUse of Hard-coded Credentials in StoneFly Storage ConcentratorEPSS 0.2%