An OS command injection flaw exists in the maintenance utility of the Hitachi Virtual Storage Platform One Block 23, 24, 26, and 28. When an attacker submits special input through the web‑based management interface, arbitrary shell commands can be executed on the underlying operating system. This type of vulnerability is a CWE‑78 flaw in input handling, allowing full compromise of confidentiality, integrity, and availability of the storage controller and any data therein.

The flaw affects Hitachi Virtual Storage Platform One Block 23, 24, 26, and 28 running firmware versions prior to DKCMAIN A3‑04‑21‑40/00 or ESM A3‑04‑21/00. Any deployment on these product lines that has not yet applied these builds is vulnerable.

The CVSS score of 8.1 classifies the risk as high. EPSS data are not provided, so the exact likelihood is unknown, though the absence of a KEV listing suggests that widespread exploitation has not yet been documented. The vulnerability is likely exploitable via the web‑based GUI, requiring access to the management network or compromised credentials. Internal attackers or those with network access to the control interface could continue to exploit the flaw until mitigated.