CVE-2026-50110
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services stored in a configuration file. Although the credentials are encoded, the encoding can be reversed to plaintext.
Risk Assessment
Exposure of these credentials could allow an attacker unauthorized access to databases, licensing, replication services, and third-party integrations, posing a risk of compromising multiple interconnected systems.
Recommendation
Immediately change all hardcoded credentials to unique, strong passwords and remove them from configuration files, implementing secure secrets management.
Other vulnerabilities in Storage Concentrator
See all- CVE-2026-56415Critical
Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges.
- CVE-2026-56413Critical
A command injection vulnerability in the ms_service.pl service of Storage Concentrator (SC & SCVM) allows an unauthenticated remote attacker to execute arbitrary commands with root privileges by sending a specially crafted packet to the default TCP port 9000.
- CVE-2026-55721Critical
SQL injection vulnerability in Storage Concentrator (SC & SCVM) exists through cookie values processed by login.pl and debug.pl scripts. Unsanitized cookie data is directly incorporated into database queries, allowing an unauthenticated remote attacker to manipulate queries and extract sensitive information such as session tokens, password hashes, and stored secret keys.
- CVE-2026-50040Medium
Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the context of the application.
Original NVD description (English source)
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS