PT-2026-54436 · Unknown · Storage Concentrator

David Yesland · Published 2026-06-30 · Updated 2026-07-01 · CVE-2026-55721

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Storage Concentrator (SC & SCVM) (affected versions not specified)

Description An issue exists where cookie values processed by the login.pl and debug.pl scripts are incorporated directly into database queries without adequate sanitization. This allows an unauthenticated remote attacker to perform SQL injection, a technique used to manipulate database queries, to extract sensitive information such as session tokens, password hashes, and stored secret keys.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-55721

Affected Products

Storage Concentrator

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-55721 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-181-06 · Note
• https://twitter.com/DFIR_Lab/status/2072144496851116047 · Twitter Post
• https://stonefly.com/contact-us · Note