Man-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.
Summary
Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component) allows Man in the Middle Attack.This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.1-00.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi | Hitachi Infrastructure Analytics Advisor | 2.0.0-00 – 4.4.0-00 | — | No fix listed | CNA |
| Hitachi | Hitachi Ops Center Analyzer | 10.0.0-00 to before 10.9.1-00 | 10.9.1-00 | Patch available | CNA |
- Hitachi Infrastructure Analytics Advisor VendorHitachi Affected 2.0.0-00 – 4.4.0-00 Fixed in — No fix listed CNA
- Hitachi Ops Center Analyzer VendorHitachi Affected 10.0.0-00 to before 10.9.1-00 Fixed in 10.9.1-00 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:* | 2.0.0-00 to before 10.9.1-00 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:* | 10.0.0-00 to before 10.9.1-00 | Vulnerable | Hitachi |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:* Versions 2.0.0-00 to before 10.9.1-00 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:* Versions 10.0.0-00 to before 10.9.1-00 Vulnerable ·Hitachi
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Linux
Remediation
- Fix · CNA Hitachi Ops Center Analyzer (Hitachi) Fixed in 10.9.1-00
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Hitachi Ops Center Analyzer — hitachi.com/products/it/software/security/info/vuls/hitachi…
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-03561 Directory Permission Vulnerability in Hitachi Ops Center AnalyzerPriority LOW 31
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4895
- 2026-10-03 Alias added: GHSA-qvrq-rvh5-v2x2
References
More Hitachi Infrastructure Analytics Advisor vulnerabilities
- TI-2022-19958 Server-Side Request Forgery Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer CVSS 3.1CRITICAL 9.8
- TI-2019-12958 A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an… CVSS 3.1HIGH 7.5
- TI-2026-01727 Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer CVSS 3.1HIGH 8.2
- TI-2020-18845 Incorrect default permissions in Hitachi Automation Director CVSS 3.1HIGH 7.1
- TI-2018-14995 A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director… CVSS 3.1MEDIUM 6.5
- TI-2022-19959 Information Exposure Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-4895 · CVE Program
- CVE-2022-4895 · NVD
- FIRST EPSS
- GHSA-qvrq-rvh5-v2x2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences