Server-Side Request Forgery Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer
Priority MEDIUM 50CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Server-Side Request Forgery (SSRF) vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Data Center Analytics, Analytics probe components), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe components) allows Server Side Request Forgery. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0075 55th percentileScored 2026-11-07
Fix Fixed Hitachi Ops Center Analyzer (Hitachi): 10.9.0-00
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi | Hitachi Infrastructure Analytics Advisor | 2.0.0-00 – 4.4.0-00 | — | No fix listed | CNA |
| Hitachi | Hitachi Ops Center Analyzer | 10.0.0-00 to before 10.9.0-00 | 10.9.0-00 | Patch available | CNA |
- Hitachi Infrastructure Analytics Advisor VendorHitachi Affected 2.0.0-00 – 4.4.0-00 Fixed in — No fix listed CNA
- Hitachi Ops Center Analyzer VendorHitachi Affected 10.0.0-00 to before 10.9.0-00 Fixed in 10.9.0-00 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:* | 2.0.0-00 – 4.4.0-00 | Vulnerable | Hitachi |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:* | 10.0.0-00 to before 10.9.0-00 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:ops_center_viewpoint:*:*:*:*:*:*:*:* | 10.8.0-00 to before 10.9.0-00 | Vulnerable | Hitachi |
- cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:* Versions 2.0.0-00 – 4.4.0-00 Vulnerable ·Hitachi
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:* Versions 10.0.0-00 to before 10.9.0-00 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:ops_center_viewpoint:*:*:*:*:*:*:*:* Versions 10.8.0-00 to before 10.9.0-00 Vulnerable ·Hitachi
Remediation
- Fix · CNA Hitachi Ops Center Analyzer (Hitachi) Fixed in 10.9.0-00
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer — hitachi.com/products/it/software/security/info/vuls/hitachi…
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2022-19959 Information Exposure Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center AnalyzerPriority LOW 28
- TI-2022-02946 Information Exposure Vulnerability in Hitachi Ops Center AnalyzerPriority LOW 28
- TI-2020-18804 Incorrect default permissions in Hitachi Infrastructure Analytics AdvisorPriority LOW 28
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41552
- 2026-10-03 Alias added: GHSA-ph2x-jpwc-wrxq
- 2026-10-06 EPSS moved to the 50th–90th percentile
References
More Hitachi Infrastructure Analytics Advisor vulnerabilities
- TI-2022-04486 Man-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer CVSS 3.1HIGH 8.6
- TI-2019-12958 A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an… CVSS 3.1HIGH 7.5
- TI-2026-01727 Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer CVSS 3.1HIGH 8.2
- TI-2020-18845 Incorrect default permissions in Hitachi Automation Director CVSS 3.1HIGH 7.1
- TI-2018-14995 A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director… CVSS 3.1MEDIUM 6.5
- TI-2022-19959 Information Exposure Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-41552 · CVE Program
- CVE-2022-41552 · NVD
- FIRST EPSS
- GHSA-ph2x-jpwc-wrxq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences