The vulnerability in HiRDB Server is an OS command injection flaw that allows an attacker to execute arbitrary operating system commands with the privileges of the database service. This can lead to complete compromise of the host, data loss, and unauthorized system changes. The weakness is identified as CWE‑78, a high severity flaw with a CVSS score of 9.8.

Affected products are Hitachi HiRDB Server Versions 10, 9, 9(32) and the corresponding ‘With Additional Function’ editions. The vulnerable releases include HiRDB Server Version 10 from 10‑00 up to (but not including) 10‑12‑01, HiRDB Server Version 9 from 09‑00 through 09‑66‑22, HiRDB Server Version 9(32) from 09‑02 through 09‑66‑22, HiRDB Server with Additional Function Version 9 from 09‑00 through 09‑66/V, and HiRDB Server with Additional Function Version 9(32) from 09‑00 through 09‑66-/V.

The CVSS score of 9.8 indicates critical severity and the vulnerability is listed as not in CISA KEV and has no EPSS score available. Likely attack vectors involve remote exploitation through the database service exposed over the network, potentially allowing unauthenticated access if the service is not properly protected. Given the high severity, the risk is substantial for any organization using the affected HiRDB releases, especially in environments where the database is reachable from untrusted networks.