CVE-2026-56415: OS Command Injection in StoneFly Storage Concentrator

Synopsis

OS command injection in StoneFly Storage Concentrator (SC and SCVM) allows a remote, unauthenticated attacker to execute arbitrary operating system commands with root-level privileges by sending a crafted HTTP request to the debug.pl script. The vulnerable endpoint performs no input sanitization and requires no authentication, making it reachable directly over the network. Successful exploitation gives the attacker full control of the underlying host. Patched-image rebuilds at versions 8.0.4.22 and 8.0.4.29 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Storage Concentrator's HTTP service over the network; the vulnerable debug.pl endpoint is exposed on the network interface.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable endpoint processes requests from any unauthenticated caller.

• Victim interactionNot required

  The attacker submits a crafted HTTP request directly to the server; no user action or victim interaction is needed to trigger execution.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout assumptions, or environmental prerequisites are required.

Blast Radius

• The attacker executes arbitrary OS commands as root, gaining complete control over the underlying host filesystem, processes, and configuration.
• All data stored or accessible on the Storage Concentrator is readable, including stored credentials, encryption keys, and customer data volumes.
• The attacker can modify or delete persisted storage data, disrupt replication, and corrupt volume metadata.
• Downstream systems connected to the Storage Concentrator (SC: high confidentiality and integrity impact; SA: low availability impact on connected infrastructure) are reachable from the compromised host, expanding the attacker's foothold within the environment.