CVE-2026-56413: OS Command Injection in StoneFly Storage Concentrator

Synopsis

OS command injection in StoneFly Storage Concentrator (SC and SCVM) allows an unauthenticated remote attacker to send a specially crafted packet to TCP port 9000, where the ms_service.pl service processes input without adequate sanitization. No credentials or victim interaction are required; the attacker sends the packet directly over the network. Successful exploitation gives the attacker arbitrary command execution with root-level privileges, enabling full system compromise. A patched-image rebuild at version 8.0.4.29 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach TCP port 9000 on the target host over the network; any internet- or LAN-exposed instance is directly at risk.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerable ms_service.pl service accepts and processes packets from unauthenticated senders.

• Victim interactionNot required

  The attacker sends a crafted packet directly to the service; no user action or social engineering is needed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or knowledge of environment-specific memory layout.

Blast Radius

• Attacker executes arbitrary OS commands with root privileges, giving full control over the underlying host or virtual machine.
• Attacker reads all data stored on or accessible through the Storage Concentrator, including volumes, snapshots, and credentials held in memory or on disk.
• Attacker modifies or destroys stored data, alters device configuration, or pivots to connected storage network segments (SC: High / SI: High impact confirmed by CVSS vector).
• Attacker disrupts availability of the Storage Concentrator itself; downstream systems depending on attached storage volumes lose access.