PT-2026-54437 · Stonefly · Storage Concentrator+1

David Yesland · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-56413

Mitre

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-56413

Affected Products

Storage Concentrator

Storage Concentrator Virtual Machine

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-56413 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json · Note
• https://stonefly.com/contact-us · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-181-06 · Note