Which versions of Storage Concentrator are affected by EUVD-2026-40459?

StoneFly Storage Concentrator (SC and SCVM) contains a critical unauthenticated SQL injection vulnerability (CVE-2026-55721, CVSS 9.2) allowing remote attackers to extract session tokens, password…. A patch is available.

How to fix or mitigate EUVD-2026-40459?

Within 24 hours: Inventory all StoneFly Storage Concentrator instances (SC and SCVM models) and assess network exposure to affected CGI scripts (login.pl, debug.pl). Within 7 days: Implement compensating controls including network segmentation to limit management interface access to authorized administrators, deploy Web Application Firewall rules blocking SQL injection patterns in HTTP cookies, and disable debug.pl if operationally feasible. Within 30 days: Monitor CISA ICS advisory ICSA-26-181-06 for vendor patch availability; conduct security assessment of appliances for indicators of unauthorized access.

Storage Concentrator EUVD-2026-40459

Q: What is the CVSS score of EUVD-2026-40459?

EUVD-2026-40459 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-55721 CRITICAL

SQL Injection (CWE-89)

2026-06-30 ics-cert@hq.dhs.gov

GHSA-864f-9wr6-7qwp

SQLi

9.2

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Unauthenticated cookie injection at a network-reachable endpoint gives AV:N/AC:L/PR:N/UI:N; disclosure of credentials usable beyond the database warrants S:C and C:H, with limited I:L and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:32 vuln.today

DescriptionCVE.org

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.

AnalysisAI

SQL injection in StoneFly Storage Concentrator (SC and SCVM) lets an unauthenticated remote attacker read sensitive database contents by injecting through the cookie value handled by the login.pl and debug.pl CGI scripts. Successful exploitation discloses session tokens, password hashes, and stored secret keys, enabling authentication bypass and broader compromise of the storage appliance. There is no public exploit identified at time of analysis, and the issue is tracked under CISA ICS advisory ICSA-26-181-06.

Technical ContextAI

Storage Concentrator is StoneFly's iSCSI/SAN storage management appliance, available as a physical product (SC) and a virtual machine (SCVM). Its web management interface is implemented with Perl CGI scripts (login.pl and debug.pl), which read an HTTP cookie value and concatenate it directly into backend SQL queries. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw: because the cookie is attacker-controlled and unsanitized, query structure can be altered to return arbitrary rows. The attack surface is notable because cookies are often overlooked as an injection source compared to URL or form parameters, and these endpoints are reachable before authentication.

RemediationAI

No vendor-released patch version was identified in the provided data; consult the CISA advisory (ICSA-26-181-06) and StoneFly support (https://stonefly.com/contact-us/) for an updated build and apply it as the primary fix once available. Until a patched version is confirmed, restrict network reachability of the Storage Concentrator management interface by placing it on an isolated management VLAN and blocking external or untrusted access to the web UI (the login.pl and debug.pl endpoints in particular); this is the most effective compensating control but reduces remote administrative convenience. Where a web application firewall or reverse proxy fronts the appliance, add rules to reject requests whose cookie values contain SQL metacharacters, accepting that signature-based filtering can be bypassed and may break legitimate sessions. After remediation, rotate all potentially exposed secrets (session tokens, account passwords, and stored secret keys), since database disclosure may already have leaked them.