Read the docs
TI-2025-02534 Aliases CVE-2025-2902GHSA-3mc2-p59g-jpp4

Missing authorization in Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090…

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix Fixed Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H (Hitachi): DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H (Hitachi): DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HitachiHitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090Hbefore DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00Patch availableCNA
HitachiHitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600Hbefore DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00Patch availableCNA
HitachiHitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00Patch availableCNA
  • Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H VendorHitachi Affected before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00 Fixed in DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00 Patch available CNA
  • Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H VendorHitachi Affected before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00 Fixed in DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00 Patch available CNA
  • Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 VendorHitachi Affected before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00 Fixed in DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00 Patch available CNA

Remediation

  • Fix · CNA Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H (Hitachi) Fixed in DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00
  • Fix · CNA Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H (Hitachi) Fixed in DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00
  • Fix · CNA Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 (Hitachi) Fixed in DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-2902
  2. 2026-10-03 Alias added: GHSA-3mc2-p59g-jpp4

References

Advisory 1

  • TI-2022-21586 Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-21503 Injection in Hitachi Vantara Pentaho Business Analytics Server KEVCVSS 3.1HIGH 8.8
  • TI-2021-11702 An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business… CVSS 3.1HIGH 7.5
  • TI-2005-00319 Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with… CVSS 2.0MEDIUM 5.0
  • TI-2022-21585 Code injection in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1HIGH 8.8
  • TI-2022-21507 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource CVSS 3.1HIGH 8.8
See all 256 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences