CISA’s June 30 advisory batch included eight industrial control systems advisories, and one stands out as immediately actionable for enterprise and OT network defenders. ICSA-26-181-06 covers multiple critical vulnerabilities in StoneFly Storage Concentrator appliances and virtual machines, collectively rated CVSS v4 9.8. The combination of an unauthenticated remote root code execution path and hardcoded credentials embedded in a configuration file places any internet-accessible or internally exposed StoneFly device at high risk of full compromise.
What the Advisories Cover
Aon Cyber Labs originally identified and disclosed the StoneFly vulnerabilities. The advisory documents four distinct vulnerability classes:
Unauthenticated command injection via TCP port 9000 — the management service (ms_service.pl) accepts crafted requests on port 9000 without authentication and passes user-controlled input to shell commands. An attacker on the network who can reach this port can execute arbitrary OS commands as root. No credentials required.
Second unauthenticated command injection in debug.pl — a separate debug interface accepts crafted HTTP requests that reach unsanitised shell execution paths. Also pre-authentication.
Hardcoded credentials in configuration files — static credentials are embedded in a configuration file accessible on the device filesystem. These can be extracted by any user with file-level access and used to authenticate to administrative interfaces.
SQL injection in login.pl and debug.pl — cookie values in the login and debug endpoints are passed to SQL queries without sanitisation, enabling extraction of session tokens, password hashes, and application secret keys.
A separate advisory in the same batch (ICSA-26-181-05) covers CVE-2025-31115 in XZ Utils 5.3.3alpha through 5.8.0, affecting B&R industrial terminal products. That vulnerability is a heap-use-after-free in the multithreaded .xz decompressor that can be triggered over the network, leading to process crash and potential code execution in affected B&R hardware.
Operational Context
StoneFly Storage Concentrator products are deployed in enterprise storage, backup, and disaster recovery environments — including in operational technology networks where storage underpins historian systems, engineering workstations, and backup infrastructure for SCADA and DCS platforms. The presence of an unauthenticated root RCE reachable via a dedicated TCP port is particularly concerning in environments where network segmentation between OT and IT zones may be incomplete.
The hardcoded credential finding compounds the risk: even in environments where port 9000 is blocked at the perimeter, any local user or attacker who has reached an adjacent system can extract static credentials and move laterally using them.
No threat actor activity specifically exploiting these StoneFly vulnerabilities has been publicly attributed as of this briefing.
Recommended Actions
Immediate: Apply the StoneFly Storage Concentrator update to version 8.0.4.29 or later, which the vendor has released to address the reported vulnerabilities. Verify the update applies to all deployed appliances and VMs.
If patching is not immediately possible: block inbound access to TCP port 9000 from all hosts that do not require management access to the Storage Concentrator. Review network access controls for the debug and login interfaces.
Audit connectivity: identify all StoneFly deployments on your network, confirm whether any are internet-reachable, and verify firewall rules for the management interfaces. StoneFly appliances should not be directly reachable from untrusted networks under any circumstances.
For B&R industrial terminals: apply manufacturer updates for affected product lines and ensure multithreaded XZ decompression is not exposed over untrusted network paths.
Longer term: add storage appliances, backup infrastructure, and device management interfaces to vulnerability management scope. These devices are frequently under-patched in OT and enterprise environments because they sit outside the standard endpoint patching cycle.