A critical command injection vulnerability in the StoneFly Storage Concentrator debug.pl script enables unauthenticated remote attackers to gain full root-level control of the system.

This vulnerability resides in the debug.pl script and is reachable via unauthenticated HTTP requests; inadequate input sanitization allows for arbitrary command execution with root privileges.

With a CVSS score of 10.0, this vulnerability is critical. An attacker can leverage this flaw to gain full administrative control over the storage concentrator, facilitating data exfiltration, service outages, or the deployment of ransomware within the storage environment.

Immediate Action: Update the StoneFly Storage Concentrator to the latest vendor-released version to patch the vulnerable debug.pl script.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting debug.pl or unusual parameter inputs that may indicate injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block malicious HTTP requests containing suspicious command payloads directed at the device.

Public Exploit Available: No

The ability for an unauthenticated user to execute commands as root via a web-accessible script makes this a high-priority threat. Organizations should treat this as an emergency remediation task and ensure the patch is applied across all affected instances immediately.