Description (CNA)
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| StoneFly / Storage Concentrator | affected 0 before 8.0.4.26; unaffected 8.0.4.29 |
| StoneFly / Storage Concentrator Virtual Machine | affected 0 before 8.0.4.26; unaffected 8.0.4.29 |
CWE
CWE-798
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json
- https://stonefly.com/contact-us/
ADP enrichment
No English description supplied.
No references supplied.