# Critical StoneFly Storage Concentrator Flaws Enable Root Access to Backup Infrastructure Worldwide
## The Threat
StoneFly Storage Concentrator, a widely deployed backup and disaster recovery appliance used across critical infrastructure sectors, contains multiple severe vulnerabilities that allow unauthenticated attackers to execute arbitrary commands with root-level privileges and gain unrestricted access to interconnected systems. The vulnerabilities stem from two fundamental design failures: hardcoded credentials embedded in configuration files and inadequate input sanitization in a core service that listens on the network with no authentication requirement.
The most critical flaw resides in the ms_service.pl service, which listens by default on TCP port 9000 and processes custom network packets to manage device operations. An attacker can send a specially crafted packet containing a malicious payload that bypasses input validation, resulting in immediate command execution with root privileges. This is not a vulnerability requiring administrative access or special conditions—any attacker with network visibility to port 9000 can exploit it remotely and instantly gain complete control of the appliance and, by extension, the backup infrastructure it manages.
Compounding this risk is CVE-2026-50110, which exposes hardcoded credentials for critical internal services stored in a configuration file. Although the credentials are encoded, the encoding is trivially reversible, giving attackers immediate access to database accounts, licensing services, replication mechanisms, and third-party integrations. For organizations relying on StoneFly for disaster recovery, this represents a catastrophic scenario: an attacker gains root access to the backup system, discovers credentials to replicated systems, and can pivot laterally across the entire backup and recovery infrastructure. In the event of a ransomware attack or breach, the backup systems themselves become weaponized against the organization.
## Severity and Impact
| Aspect | Details |
|--------|---------|
| CVE-2026-56413 | OS Command Injection in ms_service.pl |
| CVSS v3.1 Score | 10.0 (CRITICAL) |
| CVSS v4.0 Score | 10.0 (CRITICAL) |
| Vector String (v3.1) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Vector String (v4.0) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC: |
| Attack Vector | Network (unauthenticated) |
| Attack Complexity | Low (no special conditions) |
| Authentication | None required |
| Privileges Required | None |
| User Interaction | None |
| CWE Classification | CWE-78 (Improper Neutralization of Special Elements used in OS Command Injection) |
| | |
| CVE-2026-50110 | Hardcoded Credentials |
| CVSS v3.1 Score | 9.2 (CRITICAL) |
| CVSS v4.0 Score | 9.3 (CRITICAL) |
| Vector String (v3.1) | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
| Vector String (v4.0) | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L |
| Attack Vector | Local (file access) |
| CWE Classification | CWE-798 (Use of Hard-coded Credentials) |
## Affected Products
StoneFly Storage Concentrator (all versions)
StoneFly Storage Concentrator Virtual Machine (all versions)
Deployments are confirmed across critical infrastructure sectors including Defense Industrial Base, Energy, Financial Services, Healthcare and Public Health, and Information Technology, with instances identified worldwide.
## Mitigations
Immediate Actions:
1. Patch immediately: Upgrade to Storage Concentrator version 8.0.4.29 or later. This is not optional—CVSS 10.0 unauthenticated remote code execution represents an existential threat to your backup infrastructure.
2. Network segmentation: If immediate patching is not possible, restrict network access to port 9000 (ms_service.pl) to trusted administrators only. Use firewall rules to prevent any external or untrusted network access to the appliance.
3. Credential rotation: After patching, assume that all hardcoded credentials have been compromised. Change passwords for database accounts, licensing services, replication accounts, and any third-party integrations connected to the appliance.
4. Access auditing: Review logs (if available and not compromised) for any suspicious connections to port 9000 or authentication attempts using the embedded credentials. Assume any activity during the vulnerability window should be investigated.
5. Lateral movement assessment: If your StoneFly appliance is part of a larger backup ecosystem or connects to other systems (replicated environments, cloud integrations, disaster recovery sites), perform forensic analysis to determine if attackers gained access to those interconnected systems.
6. Disable unnecessary services: If ms_service.pl is not actively used in your environment, consider disabling it until patched.
For Backup Strategy Review:
## References
---
## HackWire Analysis
The combination of unauthenticated remote command execution and hardcoded credentials in a backup appliance represents one of the most dangerous vulnerability patterns in infrastructure security. Backup systems are supposed to be the last line of defense—the recovery mechanism when primary systems fail. When the backup infrastructure itself becomes an attack vector with root-level compromise, organizations face an asymmetric problem: attackers don't need to penetrate heavily defended production systems if they can compromise the backups that would otherwise enable recovery.
The placement of ms_service.pl on a world-facing port with zero authentication appears to be either a legacy design decision or a critical oversight during development. For a vendor operating in the backup space, where security-conscious customers should expect fortress-like architecture, this level of exposure is inexcusable. The fact that the command injection vulnerability requires no special techniques—just a crafted network packet—suggests this code was never subjected to basic security review before release.
What makes this advisory particularly concerning is the global deployment footprint. StoneFly appliances exist in critical infrastructure environments that are actively targeted by sophisticated threat actors. The Defense Industrial Base, Energy sector, and Financial Services sectors have all experienced significant breaches in the past 18 months. Assume this vulnerability will be weaponized immediately if not already. Organizations should treat this as an incident response scenario: patch as if attackers are already inside, rotate credentials as if they've already been stolen, and audit as if compromise has occurred. For many organizations, waiting for routine change windows or scheduled maintenance is not an option.
— HackWire Editorial
## Related Coverage