Vulnerability Description
Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-18
- https://stonefly.com/contact-us/
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06
FAQ
What is CVE-2026-55721?
CVE-2026-55721 is a vulnerability with a CVSS score of 9.3 (CRITICAL). Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries wi...
How severe is CVE-2026-55721?
CVE-2026-55721 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-55721?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.