CVE-2025-1978

Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console

Published May 7, 2026 CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Description
Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28.

This issue affects Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28  : before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00.

Analysis

AI-generated

Technical impact

The CVE identifies a remote code execution flaw (CWE-94) in the Storage Navigator and maintenance console of Hitachi Virtual Storage Platform devices. While the description does not detail the exact cause, it is inferred that the flaw arises from improper handling of code execution requests, allowing an attacker to run arbitrary code on the affected systems. This leads to compromise of confidentiality, integrity, and availability, potentially giving full control over the devices.

Affected Systems

The vulnerability affects a broad range of Hitachi Virtual Storage Platform models, including G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H and One Block 23, One Block 24, One Block 26, One Block 28. All firmware versions prior to DKCMAIN Ver. 88‑08‑16‑xx/00, SVP Ver. 88‑08‑18‑xx/00, DKCMAIN Ver. 93‑07‑26‑xx/00, SVP Ver. 93‑07‑26‑xx/00, DKCMAIN Ver. A3‑04‑02‑xx/00, MPC Ver. A3‑04‑02‑xx/00, DKCMAIN Ver. A3‑03‑41‑xx/00, MPC Ver. A3‑03‑41‑xx/00, DKCMAIN Ver. A3‑03‑03‑xx/00, and MPC Ver. A3‑03‑03‑xx/00 are affected.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity. An EPSS score is not available, and the absence of a KEV listing suggests the vulnerability is not yet widely used. The attack vector is inferred to be remote through the management interfaces, as the vulnerability affects the Storage Navigator and maintenance console; the exploit does not require local privileged access. Thus, an attacker who gains access to the console could execute arbitrary commands, leading to full takeover of the storage platform.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the affected Hitachi Virtual Storage Platform to a firmware version that is not listed among the affected pre‑release versions. The vendor provides updates that fix the code execution flaw; apply the latest patches available through the Hitachi support portal.
  • If an immediate upgrade is not possible, isolate the management network by restricting all non‑essential inbound and outbound traffic to the Storage Navigator and maintenance console interfaces, thereby limiting exposure to malicious actors. This containment measure should be combined with network segmentation and strict access control policies.
  • Enable logging and monitoring of all management interface activity. Ensure that alerts are configured for anomalous command execution or failed authentication attempts to detect potential exploitation attempts in real time.

Generated by OpenCVE AI on May 7, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Hitachi e1090
Hitachi e1090h
Hitachi e390
Hitachi e390h
Hitachi e590
Hitachi e590h
Hitachi e790
Hitachi e790h
Hitachi e990
Hitachi f350
Hitachi f370
Hitachi f700
Hitachi f900
Hitachi g130
Hitachi g150
Hitachi g350
Hitachi g370
Hitachi g700
Hitachi g900
Hitachi hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28
Vendors & Products Hitachi e1090
Hitachi e1090h
Hitachi e390
Hitachi e390h
Hitachi e590
Hitachi e590h
Hitachi e790
Hitachi e790h
Hitachi e990
Hitachi f350
Hitachi f370
Hitachi f700
Hitachi f900
Hitachi g130
Hitachi g150
Hitachi g350
Hitachi g370
Hitachi g700
Hitachi g900
Hitachi hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28
Type Values Removed Values Added
First Time appeared Hitachi
Hitachi virtual Storage One Block
Hitachi vsp E1090
Hitachi vsp E1090 Firmware
Hitachi vsp E1090h
Hitachi vsp E1090h Firmware
Hitachi vsp E390
Hitachi vsp E390 Firmware
Hitachi vsp E390h
Hitachi vsp E390h Firmware
Hitachi vsp E590
Hitachi vsp E590 Firmware
Hitachi vsp E590h
Hitachi vsp E590h Firmware
Hitachi vsp E790
Hitachi vsp E790 Firmware
Hitachi vsp E790h
Hitachi vsp E790h Firmware
Hitachi vsp E990
Hitachi vsp E990 Firmware
Hitachi vsp F350
Hitachi vsp F350 Firmware
Hitachi vsp F370
Hitachi vsp F370 Firmware
Hitachi vsp F700
Hitachi vsp F700 Firmware
Hitachi vsp F900
Hitachi vsp F900 Firmware
Hitachi vsp G130
Hitachi vsp G130 Firmware
Hitachi vsp G150
Hitachi vsp G150 Firmware
Hitachi vsp G350
Hitachi vsp G350 Firmware
Hitachi vsp G370
Hitachi vsp G370 Firmware
Hitachi vsp G700
Hitachi vsp G700 Firmware
Hitachi vsp G900
Hitachi vsp G900 Firmware
CPEs cpe:2.3:a:hitachi:virtual_storage_one_block:23:*:*:*:*:*:*:*
cpe:2.3:a:hitachi:virtual_storage_one_block:24:*:*:*:*:*:*:*
cpe:2.3:a:hitachi:virtual_storage_one_block:26:*:*:*:*:*:*:*
cpe:2.3:a:hitachi:virtual_storage_one_block:28:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e1090:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e1090h:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e390:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e390h:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e590:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e590h:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e790:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e790h:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_e990:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_f350:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_f370:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_f700:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_f900:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_g130:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_g150:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_g350:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_g370:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_g700:-:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:vsp_g900:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e1090_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e1090h_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e390_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e390h_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e590_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e590h_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e790_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e790h_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_e990_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_f350_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_f370_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_f700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_f900_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_g130_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_g150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_g350_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_g370_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_g700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hitachi:vsp_g900_firmware:-:*:*:*:*:*:*:*
Vendors & Products Hitachi
Hitachi virtual Storage One Block
Hitachi vsp E1090
Hitachi vsp E1090 Firmware
Hitachi vsp E1090h
Hitachi vsp E1090h Firmware
Hitachi vsp E390
Hitachi vsp E390 Firmware
Hitachi vsp E390h
Hitachi vsp E390h Firmware
Hitachi vsp E590
Hitachi vsp E590 Firmware
Hitachi vsp E590h
Hitachi vsp E590h Firmware
Hitachi vsp E790
Hitachi vsp E790 Firmware
Hitachi vsp E790h
Hitachi vsp E790h Firmware
Hitachi vsp E990
Hitachi vsp E990 Firmware
Hitachi vsp F350
Hitachi vsp F350 Firmware
Hitachi vsp F370
Hitachi vsp F370 Firmware
Hitachi vsp F700
Hitachi vsp F700 Firmware
Hitachi vsp F900
Hitachi vsp F900 Firmware
Hitachi vsp G130
Hitachi vsp G130 Firmware
Hitachi vsp G150
Hitachi vsp G150 Firmware
Hitachi vsp G350
Hitachi vsp G350 Firmware
Hitachi vsp G370
Hitachi vsp G370 Firmware
Hitachi vsp G700
Hitachi vsp G700 Firmware
Hitachi vsp G900
Hitachi vsp G900 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28. This issue affects Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28  : before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00.
Title Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L'}

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
Hitachi
Published
Updated
May 7, 2026, 1:40 PM
Reserved
Mar 5, 2025, 3:18 AM
Status
Analyzed
Published
May 7, 2026, 9:16 AM
Modified
Jun 17, 2026, 8:40 AM