Description
Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| StoneFly | Storage Concentrator | < 8.0.4.29 | 8.0.4.29 |
| StoneFly | Storage Concentrator Virtual Machine | < 8.0.4.29 | 8.0.4.29 |
Advisories 1
- ICSA-26-181-06 StoneFly Storage Concentrator CISA ICS & IT advisories · Jun 30, 2026