The vulnerability is a web application weakness that allows an attacker to inject arbitrary client‑side script through the Hitachi Infrastructure Analytics Advisor’s Analytics probe component and the Hitachi Ops Center Analyzer. This client‑side code injection can cause the victim’s browser to execute malicious JavaScript, potentially leading to cross‑site request forgery, credential theft, or other session‑related attacks. The weakness is classified as CWE‑79, indicating improper input sanitization in a web context.

Affected versions are Hitachi Infrastructure Analytics Advisor 10.0.0‑00 up to, but not including, 11.0.5‑00, and Hitachi Ops Center Analyzer 10.0.0‑00 up to, but not including, 11.0.5‑00. These products are used in enterprise infrastructure monitoring and analytics.

The CVSS base score of 8.2 reflects a high severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is a web‑based input that accepts user data and fails to properly sanitize it, allowing a malicious script to be stored or reflected, requiring an attacker to send a crafted request to the affected system. While the exact prerequisites are not disclosed, such XSS bugs typically require access to the web interface and may succeed without authentication if the input is publicly exposed.