Read the docs
TI-2020-18866 Aliases CVE-2020-36695GHSA-m5wh-8x43-f8p3

File and Directory Permission Vulnerability in Hitachi Command Suite

Priority LOW 33CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi Tuning Manager - Agent for NAS components), Hitachi Compute Systems Manager on Linux allows File Manipulation.This issue affects Hitachi Device Manager: before 8.8.5-02; Hitachi Tiered Storage Manager: before 8.8.5-02; Hitachi Replication Manager: before 8.8.5-02; Hitachi Tuning Manager: before 8.8.5-02; Hitachi Compute Systems Manager: before 8.8.3-08.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed Hitachi Device Manager (Hitachi): 8.8.5-02Hitachi Tiered Storage Manager (Hitachi): 8.8.5-02+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HitachiHitachi Device Managerbefore 8.8.5-028.8.5-02Patch availableCNA
HitachiHitachi Tiered Storage Managerbefore 8.8.5-028.8.5-02Patch availableCNA
HitachiHitachi Replication Managerbefore 8.8.5-028.8.5-02Patch availableCNA
HitachiHitachi Tuning Managerbefore 8.8.5-028.8.5-02Patch availableCNA
HitachiHitachi Compute Systems Managerbefore 8.8.3-088.8.3-08Patch availableCNA
  • Hitachi Device Manager VendorHitachi Affected before 8.8.5-02 Fixed in 8.8.5-02 Patch available CNA
  • Hitachi Tiered Storage Manager VendorHitachi Affected before 8.8.5-02 Fixed in 8.8.5-02 Patch available CNA
  • Hitachi Replication Manager VendorHitachi Affected before 8.8.5-02 Fixed in 8.8.5-02 Patch available CNA
  • Hitachi Tuning Manager VendorHitachi Affected before 8.8.5-02 Fixed in 8.8.5-02 Patch available CNA
  • Hitachi Compute Systems Manager VendorHitachi Affected before 8.8.3-08 Fixed in 8.8.3-08 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:hitachi:compute_systems_manager:*:*:*:*:*:*:*:*before 8.8.3-08VulnerableHitachi
cpe:2.3:a:hitachi:device_manager:*:*:*:*:*:*:*:*before 8.8.5-02VulnerableHitachi
cpe:2.3:a:hitachi:replication_manager:*:*:*:*:*:*:*:*before 8.8.5-02VulnerableHitachi
cpe:2.3:a:hitachi:tiered_storage_manager:*:*:*:*:*:*:*:*before 8.8.5-02VulnerableHitachi
cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:*:*:*before 8.8.5-02VulnerableHitachi
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
  • cpe:2.3:a:hitachi:compute_systems_manager:*:*:*:*:*:*:*:* Versions before 8.8.3-08 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:device_manager:*:*:*:*:*:*:*:* Versions before 8.8.5-02 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:replication_manager:*:*:*:*:*:*:*:* Versions before 8.8.5-02 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:tiered_storage_manager:*:*:*:*:*:*:*:* Versions before 8.8.5-02 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:*:*:* Versions before 8.8.5-02 Vulnerable ·Hitachi
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

  • Fix · CNA Hitachi Device Manager (Hitachi) Fixed in 8.8.5-02
  • Fix · CNA Hitachi Tiered Storage Manager (Hitachi) Fixed in 8.8.5-02
  • Fix · CNA Hitachi Replication Manager (Hitachi) Fixed in 8.8.5-02
  • Fix · CNA Hitachi Tuning Manager (Hitachi) Fixed in 8.8.5-02
  • Fix · CNA Hitachi Compute Systems Manager (Hitachi) Fixed in 8.8.3-08

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Hitachi Replication Manager 8.8.5-02

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-03792 EL Injection Vulnerability in Hitachi Replication ManagerPriority MEDIUM 49
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36695
  2. 2026-10-03 Alias added: GHSA-m5wh-8x43-f8p3

References

Advisory 1

  • TI-2018-14988 A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an… CVSS 3.1HIGH 7.5
  • TI-2018-10583 An Information Exposure issue was discovered in Hitachi Command Suite 8.5.3. CVSS 3.0HIGH 7.5
  • TI-2018-14995 A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director… CVSS 3.1MEDIUM 6.5
  • TI-2018-14994 A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation… CVSS 3.1MEDIUM 4.3
  • TI-2015-01399 Cross-site scripting (XSS) vulnerability in the online help in Hitachi Device Manager… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences