The Hitachi Disk Array Driver for AIX and the Virtual I/O Server driver contain an insecure handling of temporary files. This flaw allows an attacker to read or overwrite files that the driver creates during operation, potentially exposing sensitive data or altering driver behavior, which could lead to privilege escalation. The weakness corresponds to CWE‑377, indicating that temporary files are not protected against disclosure or tampering.

Affected versions include Hitachi Disk Array Driver for AIX versions 01‑00 through before 01‑23‑A, and Hitachi Disk Array Driver for Virtual I/O Server versions 01‑04 through before 01‑23‑A. Only these product families and version ranges are impacted.

With a CVSS score of 7.9 the vulnerability is classified as high severity. The EPSS score of less than 1% suggests a very low likelihood of active exploitation at this time, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need the ability to invoke the driver’s temporary file creation routine—likely requiring local privileged access or, if the driver processes network traffic, a remote push through a network interface—to exploit this weakness. Successful exploitation could permit unauthorized file reads or writes and potentially lead to privilege escalation or data compromise.