The vulnerability exists when the password reset feature is enabled and email is configured, and the system does not limit attempts to enter the reset code. An attacker can brute‑force the reset code to take over any user account, including accounts with administrative privileges. This enables the attacker to configure the application or request log collection, but device credentials and customer data remain inaccessible.

Hitachi Vantara Remote Ops Agent is affected, with all releases prior to version 2.1 susceptible. The vendor recommends upgrading to Remote Ops Agent 2.1 or later to remediate the issue.

The CVSS score of 9.1 signals a high severity vulnerability. EPSS data is not available, and it is not listed in the CISA KEV catalog, but the lack of rate limiting creates a clear attack path for remote brute‑force attempts targeting the password reset endpoint. Attackers would need knowledge of a user’s email address or be able to enumerate valid addresses to launch the brute‑force attack. Successful exploitation results in full administrative access to the application.