EUVD-2026-40458
GHSA-8h25-3425-5fgh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requires victim interaction (UI:R), changes scope to the victim's browser context (S:C), with limited session confidentiality and unauthorized action integrity impact; no availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the context of the application. This could be leveraged to steal session cookies, redirect users, or perform unauthorized actions on behalf of the victim.
AnalysisAI
Reflected XSS in Stonefly Storage Concentrator (SC) and Storage Concentrator Virtual Machine (SCVM) allows an unauthenticated attacker to craft a malicious URL that, when opened by an authenticated storage administrator, causes arbitrary JavaScript to execute within the victim's browser session under the application's origin. The vulnerability stems from unsanitized user-supplied content being echoed directly into 404 error page responses, enabling session cookie theft, unauthorized administrative actions, or user redirection against storage management infrastructure. Reported via ICS-CERT (CISA advisory ICSA-26-181-06), no public exploit code or CISA KEV listing has been identified at time of analysis, though the ICS/OT context amplifies the downstream impact of successful exploitation.
Technical ContextAI
Stonefly Storage Concentrator is an ICS/OT-oriented storage management product available in both physical appliance (SC) and virtualized (SCVM) form factors, both affected per CPE strings cpe:2.3:a:stonefly:storage_concentrator:*:*:*:*:*:*:*:* and cpe:2.3:a:stonefly:storage_concentrator_virtual_machine:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS pattern where user-controlled data - specifically URL path or query parameters that produce a 404 response - is rendered in the HTTP error page without output encoding or sanitization. Because the malicious content executes within the same browser origin as the legitimate application, it inherits full access to the victim's session state, DOM, and cookies bound to that origin. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms network delivery with no attack requirements, while the subsequent-system impact metrics (SC:L) capture the browser-context scope change characteristic of reflected XSS.
RemediationAI
No specific patched version has been identified in the available data; contact Stonefly directly at https://stonefly.com/contact-us/ referencing CISA advisory ICSA-26-181-06 to obtain patch availability and target fix versions. Monitor the CISA advisory page at https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06 for updates. Until a vendor-issued patch is applied, restrict access to the Storage Concentrator web management interface to dedicated management VLANs or jump hosts, preventing untrusted external parties from delivering crafted URLs to authenticated users - note this does not eliminate insider or phishing risk but significantly reduces the attacker's delivery surface. If a reverse proxy or WAF is deployed in front of the SC interface, configure Content-Security-Policy headers to block inline script execution (e.g., script-src 'self'); be aware this may break legitimate UI functionality and should be tested in a non-production environment first. Train storage administrators to avoid clicking unsolicited links while authenticated to the SC management interface, and implement session timeout policies to reduce the window of opportunity for exploiting a stolen session.
More in Storage Concentrator
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today