PT-2026-54437 · Stonefly · Storage Concentrator+1

David Yesland · Publicado 2026-06-30 · Atualizado 2026-06-30 · CVE-2026-56413

Mitre

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-56413

Produtos afetados

Storage Concentrator

Storage Concentrator Virtual Machine

Referências · 4

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json · Nota
• https://stonefly.com/contact-us · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56413 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-26-181-06 · Nota