CVE-2024-30213
Published: 12 July 2024
Summary
CVE-2024-30213 is a high-severity Command Injection (CWE-77) vulnerability in Stonefly (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
StoneFly Storage Concentrator (SC and SCVM) versions prior to 8.0.4.26 contain a command injection vulnerability tracked as CVE-2024-30213 and CWE-77. The flaw resides in the Ping URL feature and permits remote code execution when triggered by an authenticated user. The issue carries a CVSS 3.1 score of 8.8 with network attack vector, low complexity, and low privileges required.
Remote authenticated attackers can send crafted requests to the Ping URL over the network to inject and execute arbitrary operating-system commands. Successful exploitation grants full control over the affected storage appliance, enabling confidentiality, integrity, and availability impacts without user interaction.
Vendor advisories published at stonefly.com/security-advisories/cve-2024-30213/ identify the affected releases and direct customers to upgrade to version 8.0.4.26 or later. The EPSS score remains flat at 0.0667 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-28144
Vulnerability details
StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, leading to remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.