Read the docs
TI-2025-01723 Aliases CVE-2025-1978GHSA-rprw-c6w3-xx2q

Code injection in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900…

Priority MEDIUM 49CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28. This issue affects Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28  : before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00547 46th percentileScored 2026-11-07
Fix Fixed Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 (Hitachi): DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00 +7Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H (Hitachi): DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00 +7+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HitachiHitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00Patch availableCNA
HitachiHitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090Hbefore DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00Patch availableCNA
HitachiHitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00Patch availableCNA
  • Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 VendorHitachi Affected before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Patch available CNA
  • Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H VendorHitachi Affected before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Patch available CNA
  • Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 VendorHitachi Affected before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Patch available CNA

CPE configurations NVD · 42

CPEVersionsRoleVendor
cpe:2.3:a:hitachi:virtual_storage_one_block:23:*:*:*:*:*:*:*23VulnerableHitachi
cpe:2.3:a:hitachi:virtual_storage_one_block:24:*:*:*:*:*:*:*24VulnerableHitachi
cpe:2.3:a:hitachi:virtual_storage_one_block:26:*:*:*:*:*:*:*26VulnerableHitachi
cpe:2.3:a:hitachi:virtual_storage_one_block:28:*:*:*:*:*:*:*28VulnerableHitachi
cpe:2.3:o:hitachi:vsp_g130_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_g130:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_g150_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_g150:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_g350_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_g350:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
  • cpe:2.3:a:hitachi:virtual_storage_one_block:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:virtual_storage_one_block:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:virtual_storage_one_block:26:*:*:*:*:*:*:* Versions 26 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:virtual_storage_one_block:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Hitachi
  • cpe:2.3:o:hitachi:vsp_g130_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_g130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_g150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_g150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_g350_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_g350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
Show 32 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:hitachi:vsp_g370_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_g370:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_g700_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_g700:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_g900_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_g900:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_f350_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_f350:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_f370_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_f370:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_f700_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_f700:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_f900_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_f900:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e390_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e390:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e590_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e590:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e790_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e790:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e990_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e990:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e1090_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e1090:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e390h_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e390h:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e590h_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e590h:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e790h_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e790h:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
cpe:2.3:o:hitachi:vsp_e1090h_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHitachi
cpe:2.3:h:hitachi:vsp_e1090h:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi
  • cpe:2.3:o:hitachi:vsp_g370_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_g370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_g700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_g700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_g900_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_g900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_f350_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_f350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_f370_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_f370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_f700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_f700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_f900_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_f900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e390_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e590_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e790_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e790:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e990_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e990:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e1090_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e1090:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e390h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e390h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e590h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e590h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e790h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e790h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
  • cpe:2.3:o:hitachi:vsp_e1090h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
  • cpe:2.3:h:hitachi:vsp_e1090h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi

Remediation

  • Fix · CNA Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 (Hitachi) Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00
  • Fix · CNA Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H (Hitachi) Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00
  • Fix · CNA Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 (Hitachi) Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1978
  2. 2026-10-03 Alias added: GHSA-rprw-c6w3-xx2q

References

  • TI-2025-08853 OS command injection in Hitachi Virtual Storage Platform One Block 23 CVSS 3.1CRITICAL 9.8
  • TI-2025-02185 Improper Restriction of Excessive Authentication Attempts vulnerability in Hitachi Virtual Storage Platform CVSS 3.1MEDIUM 5.3

Sources