CVE-2026-55721

SQL Injection in StoneFly Storage Concentrator

CVSS 9.2 CRITICALCWE-89

Vexday Risk Score

25Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.2EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 jun 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Produtos afetados

StoneFly · Storage Concentrator StoneFly · Storage Concentrator Virtual Machine

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json https://stonefly.com/contact-us/https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06