Description

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.

Severity (CVSS)

Base score9.3
SeverityCritical
VersionCVSS 4.0
VectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
Provided byCNA

Weaknesses

  • CWE-798 — CWE-798 Use of Hard-coded Credentials

Affected products

VendorProductVersions
StoneFlyStorage Concentrator0 to <8.0.4.26; 8.0.4.29
StoneFlyStorage Concentrator Virtual Machine0 to <8.0.4.26; 8.0.4.29

References

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 01 Jul 2026 07:05 UTC.