Code injection in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28. This issue affects Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 : before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi | Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 | before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 | DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 | Patch available | CNA |
| Hitachi | Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H | before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 | DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 | Patch available | CNA |
| Hitachi | Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 | before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 | DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 | Patch available | CNA |
- Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 VendorHitachi Affected before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Patch available CNA
- Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H VendorHitachi Affected before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Patch available CNA
- Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 VendorHitachi Affected before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 Patch available CNA
CPE configurations NVD · 42
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hitachi:virtual_storage_one_block:23:*:*:*:*:*:*:* | 23 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:virtual_storage_one_block:24:*:*:*:*:*:*:* | 24 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:virtual_storage_one_block:26:*:*:*:*:*:*:* | 26 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:virtual_storage_one_block:28:*:*:*:*:*:*:* | 28 | Vulnerable | Hitachi |
| cpe:2.3:o:hitachi:vsp_g130_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_g130:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_g150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_g150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_g350_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_g350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
- cpe:2.3:a:hitachi:virtual_storage_one_block:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:virtual_storage_one_block:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:virtual_storage_one_block:26:*:*:*:*:*:*:* Versions 26 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:virtual_storage_one_block:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Hitachi
- cpe:2.3:o:hitachi:vsp_g130_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_g130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_g150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_g150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_g350_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_g350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
Show 32 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachi:vsp_g370_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_g370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_g700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_g700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_g900_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_g900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_f350_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_f350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_f370_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_f370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_f700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_f700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_f900_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_f900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e390_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e590_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e790_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e790:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e990_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e990:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e1090_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e1090:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e390h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e390h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e590h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e590h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e790h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e790h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
| cpe:2.3:o:hitachi:vsp_e1090h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Hitachi |
| cpe:2.3:h:hitachi:vsp_e1090h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi |
- cpe:2.3:o:hitachi:vsp_g370_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_g370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_g700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_g700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_g900_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_g900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_f350_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_f350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_f370_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_f370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_f700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_f700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_f900_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_f900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e390_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e590_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e790_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e790:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e990_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e990:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e1090_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e1090:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e390h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e390h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e590h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e590h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e790h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e790h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
- cpe:2.3:o:hitachi:vsp_e1090h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hitachi
- cpe:2.3:h:hitachi:vsp_e1090h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi
Remediation
- Fix · CNA Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 (Hitachi) Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00
- Fix · CNA Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H (Hitachi) Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00
- Fix · CNA Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 (Hitachi) Fixed in DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1978
- 2026-10-03 Alias added: GHSA-rprw-c6w3-xx2q
References
More Hitachi Virtual Storage One Block vulnerabilities
- TI-2025-08853 OS command injection in Hitachi Virtual Storage Platform One Block 23 CVSS 3.1CRITICAL 9.8
- TI-2025-02185 Improper Restriction of Excessive Authentication Attempts vulnerability in Hitachi Virtual Storage Platform CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-1978 · CVE Program
- CVE-2025-1978 · NVD
- FIRST EPSS
- GHSA-rprw-c6w3-xx2q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences