CVE-2026-55721 PUBLISHED

SQL Injection in StoneFly Storage Concentrator

Assigner: icscert
Reserved: 22.06.2026 Published: 30.06.2026 Updated: 30.06.2026

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
CVSS Score: 9.2

Product Status

Vendor StoneFly
Product Storage Concentrator
Versions Default: unaffected
  • affected from 0 to 8.0.4.22 (excl.)
  • Version 8.0.4.29 is unaffected
Vendor StoneFly
Product Storage Concentrator Virtual Machine
Versions Default: unaffected
  • affected from 0 to 8.0.4.22 (excl.)
  • Version 8.0.4.29 is unaffected

Solutions

For additional questions or support, users may contact StoneFly at  https://stonefly.com/contact-us/

Credits

  • David Yesland of Rhino Security Labs reported this vulnerability to CISA. reporter

References

Problem Types

  • CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') CWE