StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, leading to remote code execution.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')