CVE-2026-50110: StoneFly Storage Concentrator, заобикаляне на вход и

Описание

Оригинално описание

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.

Засегнати продукти

• StoneFly Storage Concentrator: преди 8.0.4.26; 8.0.4.29
• StoneFly Storage Concentrator Virtual Machine: преди 8.0.4.26; 8.0.4.29

Вид слабост

• CWE-798 Use of Hard-coded Credentials

История

Други уязвимости в StoneFly Storage Concentrator

• 10.0CVE-2026-56413
• 10.0CVE-2026-56415
• 9.3CVE-2026-55721
• 6.1CVE-2026-50040

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-50110
• https://nvd.nist.gov/vuln/detail/CVE-2026-50110
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json
• https://stonefly.com/contact-us/