Incorrect default permissions in Hitachi Infrastructure Analytics Advisor
Priority LOW 28CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00; Hitachi Ops Center Viewpoint: from 10.8.0-00 before 10.9.0-00.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Fix Fixed Hitachi Ops Center Analyzer (Hitachi): 10.9.0-00Hitachi Ops Center Viewpoint (Hitachi): 10.9.0-00
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi | Hitachi Infrastructure Analytics Advisor | 2.0.0-00 – 4.4.0-00 | — | No fix listed | CNA |
| Hitachi | Hitachi Ops Center Analyzer | 10.0.0-00 to before 10.9.0-00 | 10.9.0-00 | Patch available | CNA |
| Hitachi | Hitachi Ops Center Viewpoint | 10.8.0-00 to before 10.9.0-00 | 10.9.0-00 | Patch available | CNA |
- Hitachi Infrastructure Analytics Advisor VendorHitachi Affected 2.0.0-00 – 4.4.0-00 Fixed in — No fix listed CNA
- Hitachi Ops Center Analyzer VendorHitachi Affected 10.0.0-00 to before 10.9.0-00 Fixed in 10.9.0-00 Patch available CNA
- Hitachi Ops Center Viewpoint VendorHitachi Affected 10.8.0-00 to before 10.9.0-00 Fixed in 10.9.0-00 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:* | 2.0.0-00 – 4.4.0-00 | Vulnerable | Hitachi |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:* | 10.0.0-00 to before 10.9.0-00 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:ops_center_viewpoint:*:*:*:*:*:*:*:* | 10.8.0-00 to before 10.9.0-00 | Vulnerable | Hitachi |
- cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:* Versions 2.0.0-00 – 4.4.0-00 Vulnerable ·Hitachi
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:* Versions 10.0.0-00 to before 10.9.0-00 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:ops_center_viewpoint:*:*:*:*:*:*:*:* Versions 10.8.0-00 to before 10.9.0-00 Vulnerable ·Hitachi
Remediation
- Fix · CNA Hitachi Ops Center Analyzer (Hitachi) Fixed in 10.9.0-00
- Fix · CNA Hitachi Ops Center Viewpoint (Hitachi) Fixed in 10.9.0-00
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer — hitachi.com/products/it/software/security/info/vuls/hitachi…
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2022-19958 Server-Side Request Forgery Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center AnalyzerPriority MEDIUM 50
- TI-2022-19959 Information Exposure Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center AnalyzerPriority LOW 28
- TI-2022-02946 Information Exposure Vulnerability in Hitachi Ops Center AnalyzerPriority LOW 28
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36605
- 2026-10-03 Alias added: GHSA-rw84-x9xw-mh38
References
More Hitachi Infrastructure Analytics Advisor vulnerabilities
- TI-2022-19958 Server-Side Request Forgery Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer CVSS 3.1CRITICAL 9.8
- TI-2022-04486 Man-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer CVSS 3.1HIGH 8.6
- TI-2019-12958 A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an… CVSS 3.1HIGH 7.5
- TI-2026-01727 Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer CVSS 3.1HIGH 8.2
- TI-2020-18845 Incorrect default permissions in Hitachi Automation Director CVSS 3.1HIGH 7.1
- TI-2018-14995 A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-36605 · CVE Program
- CVE-2020-36605 · NVD
- FIRST EPSS
- GHSA-rw84-x9xw-mh38 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences