Storage Concentrator vulnerabilities
4 known vulnerabilities in Storage Concentrator from StoneFly. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 10.0 Critical severity
Storage Concentrator: Improper Neutralization of Special Elements used in an OS Command
Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed with
- 10.0 Critical severity
Storage Concentrator: Improper Neutralization of Special Elements used in an OS Command
Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a spec
- 9.3 Critical severity
Storage Concentrator: Improper Neutralization of Special Elements used in an SQL Command
Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated rem
- 9.2 Critical severity
Storage Concentrator: Use of Hard-coded Credentials
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span