OS command injection in Hitachi Virtual Storage Platform One Block 23
Priority MEDIUM 45CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28. This issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.009 59th percentileScored 2026-11-07
Fix Fixed Hitachi Virtual Storage Platform One Block 23 (Hitachi): DKCMAIN A3-04-21-40/00, ESM A3-04-21/00Hitachi Virtual Storage Platform One Block 24 (Hitachi): DKCMAIN A3-04-21-40/00, ESM A3-04-21/00+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi | Hitachi Virtual Storage Platform One Block 23 | before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 | DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 | Patch available | CNA |
| Hitachi | Hitachi Virtual Storage Platform One Block 24 | before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 | DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 | Patch available | CNA |
| Hitachi | Hitachi Virtual Storage Platform One Block 26 | before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 | DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 | Patch available | CNA |
| Hitachi | Hitachi Virtual Storage Platform One Block 28 | before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 | DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 | Patch available | CNA |
- Hitachi Virtual Storage Platform One Block 23 VendorHitachi Affected before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 Fixed in DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 Patch available CNA
- Hitachi Virtual Storage Platform One Block 24 VendorHitachi Affected before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 Fixed in DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 Patch available CNA
- Hitachi Virtual Storage Platform One Block 26 VendorHitachi Affected before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 Fixed in DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 Patch available CNA
- Hitachi Virtual Storage Platform One Block 28 VendorHitachi Affected before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 Fixed in DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hitachi:virtual_storage_one_block:23:*:*:*:*:*:*:* | 23 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:virtual_storage_one_block:24:*:*:*:*:*:*:* | 24 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:virtual_storage_one_block:26:*:*:*:*:*:*:* | 26 | Vulnerable | Hitachi |
| cpe:2.3:a:hitachi:virtual_storage_one_block:28:*:*:*:*:*:*:* | 28 | Vulnerable | Hitachi |
- cpe:2.3:a:hitachi:virtual_storage_one_block:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:virtual_storage_one_block:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:virtual_storage_one_block:26:*:*:*:*:*:*:* Versions 26 Vulnerable ·Hitachi
- cpe:2.3:a:hitachi:virtual_storage_one_block:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Hitachi
Remediation
- Fix · CNA Hitachi Virtual Storage Platform One Block 23 (Hitachi) Fixed in DKCMAIN A3-04-21-40/00, ESM A3-04-21/00
- Fix · CNA Hitachi Virtual Storage Platform One Block 24 (Hitachi) Fixed in DKCMAIN A3-04-21-40/00, ESM A3-04-21/00
- Fix · CNA Hitachi Virtual Storage Platform One Block 26 (Hitachi) Fixed in DKCMAIN A3-04-21-40/00, ESM A3-04-21/00
- Fix · CNA Hitachi Virtual Storage Platform One Block 28 (Hitachi) Fixed in DKCMAIN A3-04-21-40/00, ESM A3-04-21/00
Timeline
- 2026-10-02 Threatist record created from CVE-2025-9661
- 2026-10-03 Alias added: GHSA-4xr5-xgm7-4447
References
More Hitachi Virtual Storage One Block vulnerabilities
- TI-2025-01723 Code injection in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900… CVSS 3.1CRITICAL 9.8
- TI-2025-02185 Improper Restriction of Excessive Authentication Attempts vulnerability in Hitachi Virtual Storage Platform CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-9661 · CVE Program
- CVE-2025-9661 · NVD
- FIRST EPSS
- GHSA-4xr5-xgm7-4447 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences