A stack-based buffer overflow has been discovered in the JP1/Automatic Job Management System 3 Manager component, allowing an attacker to overwrite the stack and potentially execute arbitrary code. This flaw arises from lack of bounds checking on user-supplied input and is classified as CWE-121. In practice, exploitation could give an attacker full control over the affected system, compromising confidentiality, integrity, and availability.

Hitachi’s JP1/Automatic Job Management System 3 Manager is affected in all releases from 10-00 through, but not including, 13-50-31. The vulnerability is present in every build prior to the 13-50-31 update and has been fixed in later versions. No other vendors or products are part of the affected set.

The CVSS score of 9.4 categorizes this as a critical issue. While no EPSS score is available and the flaw is not currently listed in the CISA KEV catalog, the classic stack overflow nature suggests that a determined attacker could craft a malicious payload sent over the network to trigger the flaw, resulting in remote code execution. The attack vector is not explicitly documented; however, because the Manager service is typically exposed within an internal network, a local or privileged network attacker is presumed to be the most likely onslaught profile.