Read the docs
TI-2025-40267 Aliases CVE-2025-65115GHSA-h2gf-w3wm-8xqj

Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM

Priority MEDIUM 44CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00624 50th percentileScored 2026-11-07
Fix Fixed JP1/IT Desktop Management 2 - Manager (Hitachi): 13-50-02, 13-11-04, 13-10-07 +3JP1/IT Desktop Management 2 - Operations Director (Hitachi): 13-50-02, 13-11-04, 13-10-07 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HitachiJP1/IT Desktop Management 2 - Manager13-50 to before 13-50-02; 13-11 to before 13-11-04; 13-10 to before 13-10-07; 13-01 to before 13-01-07; 13-00 to before 13-00-05; 12-60 to before 12-60-12; 10-50 – 12-50-1113-50-02, 13-11-04, 13-10-07, 13-01-07, 13-00-05, 12-60-12Patch availableCNA
HitachiJP1/IT Desktop Management 2 - Operations Director13-50 to before 13-50-02; 13-11 to before 13-11-04; 13-10 to before 13-10-07; 13-01 to before 13-01-07; 13-00 to before 13-00-05; 12-60 to before 12-60-12; 10-50 – 12-50-1113-50-02, 13-11-04, 13-10-07, 13-01-07, 13-00-05, 12-60-12Patch availableCNA
HitachiJob Management Partner 1/IT Desktop Management 2 - Manager10-50 – 10-50-11—No fix listedCNA
HitachiJP1/IT Desktop Management - Manager09-50 – 10-10-16—No fix listedCNA
HitachiJob Management Partner 1/IT Desktop Management - Manager09-50 – 10-10-16—No fix listedCNA
HitachiJP1/NETM/DM Manager09-00 – 10-20-02—No fix listedCNA
HitachiJP1/NETM/DM Client09-00 – 10-20-02—No fix listedCNA
HitachiJob Management Partner 1/Software Distribution Manager09-00 – 09-51-13—No fix listedCNA
HitachiJob Management Partner 1/Software Distribution Client09-00 – 09-51-13—No fix listedCNA
  • JP1/IT Desktop Management 2 - Manager VendorHitachi Affected 13-50 to before 13-50-02; 13-11 to before 13-11-04; 13-10 to before 13-10-07; 13-01 to before 13-01-07; 13-00 to before 13-00-05; 12-60 to before 12-60-12; 10-50 – 12-50-11 Fixed in 13-50-02, 13-11-04, 13-10-07, 13-01-07, 13-00-05, 12-60-12 Patch available CNA
  • JP1/IT Desktop Management 2 - Operations Director VendorHitachi Affected 13-50 to before 13-50-02; 13-11 to before 13-11-04; 13-10 to before 13-10-07; 13-01 to before 13-01-07; 13-00 to before 13-00-05; 12-60 to before 12-60-12; 10-50 – 12-50-11 Fixed in 13-50-02, 13-11-04, 13-10-07, 13-01-07, 13-00-05, 12-60-12 Patch available CNA
  • Job Management Partner 1/IT Desktop Management 2 - Manager VendorHitachi Affected 10-50 – 10-50-11 Fixed in — No fix listed CNA
  • JP1/IT Desktop Management - Manager VendorHitachi Affected 09-50 – 10-10-16 Fixed in — No fix listed CNA
  • Job Management Partner 1/IT Desktop Management - Manager VendorHitachi Affected 09-50 – 10-10-16 Fixed in — No fix listed CNA
  • JP1/NETM/DM Manager VendorHitachi Affected 09-00 – 10-20-02 Fixed in — No fix listed CNA
  • JP1/NETM/DM Client VendorHitachi Affected 09-00 – 10-20-02 Fixed in — No fix listed CNA
  • Job Management Partner 1/Software Distribution Manager VendorHitachi Affected 09-00 – 09-51-13 Fixed in — No fix listed CNA
  • Job Management Partner 1/Software Distribution Client VendorHitachi Affected 09-00 – 09-51-13 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:hitachi:job_management_partner_1\/it_desktop_management-manager:*:*:*:*:*:*:*:*09-50 – 09-50-03; 09-51 – 09-51-05; 10-00 – 10-00-02; 10-01 – 10-01-05; 10-02 – 10-02-05; 10-10 – 10-10-16VulnerableHitachi
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:hitachi:jp1\/it_desktop_management_2-manager:*:*:*:*:*:*:*:*10-50 – 10-50-12; 11-00 – 11-00-11; 11-01 – 11-01-12; 11-10 – 11-10-10; 11-50 – 11-50-08; 11-51 – 11-51-10; 12-00 – 12-00-09; 12-10 – 12-10-12; 12-50 – 12-50-11; 12-60 – 12-60-11; 13-00 – 13-00-04; 13-01 – 13-01-06; 13-10 – 13-10-06; 13-11 – 13-11-03; 13-50 – 13-50-01VulnerableHitachi
cpe:2.3:a:hitachi:jp1\/it_desktop_management_2-operations_director:*:*:*:*:*:*:*:*10-50 – 10-50-12; 11-00 – 11-00-11; 11-01 – 11-01-12; 11-10 – 11-10-10; 11-50 – 11-50-08; 11-51 – 11-51-10; 12-00 – 12-00-09; 12-10 – 12-10-12; 12-50 – 12-50-11; 12-60 – 12-60-11; 13-00 – 13-00-04; 13-01 – 13-01-06; 13-10 – 13-10-06; 13-11 – 13-11-03; 13-50 – 13-50-01VulnerableHitachi
cpe:2.3:a:hitachi:jp1\/netm\/dm_manager:*:*:*:*:*:*:*:*09-00 – 09-00-14; 09-01 – 09-01-14; 09-10 – 09-10-15; 09-12 – 09-12-16; 09-50 – 09-50-20; 09-51 – 09-51-14; 10-10 – 10-10-25; 10-20 – 10-20-02VulnerableHitachi
cpe:2.3:a:hitachi:jp1\/netm\/dm_client:*:*:*:*:*:*:*:*09-00 – 09-00-14; 09-01 – 09-01-14; 09-10 – 09-10-15; 09-12 – 09-12-16; 09-50 – 09-50-20; 09-51 – 09-51-14; 10-10 – 10-10-25; 10-20 – 10-20-02VulnerableHitachi
  • cpe:2.3:a:hitachi:job_management_partner_1\/it_desktop_management-manager:*:*:*:*:*:*:*:* Versions 09-50 – 09-50-03; 09-51 – 09-51-05; 10-00 – 10-00-02; 10-01 – 10-01-05; 10-02 – 10-02-05; 10-10 – 10-10-16 Vulnerable ·Hitachi
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:hitachi:jp1\/it_desktop_management_2-manager:*:*:*:*:*:*:*:* Versions 10-50 – 10-50-12; 11-00 – 11-00-11; 11-01 – 11-01-12; 11-10 – 11-10-10; 11-50 – 11-50-08; 11-51 – 11-51-10; 12-00 – 12-00-09; 12-10 – 12-10-12; 12-50 – 12-50-11; 12-60 – 12-60-11; 13-00 – 13-00-04; 13-01 – 13-01-06; 13-10 – 13-10-06; 13-11 – 13-11-03; 13-50 – 13-50-01 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:jp1\/it_desktop_management_2-operations_director:*:*:*:*:*:*:*:* Versions 10-50 – 10-50-12; 11-00 – 11-00-11; 11-01 – 11-01-12; 11-10 – 11-10-10; 11-50 – 11-50-08; 11-51 – 11-51-10; 12-00 – 12-00-09; 12-10 – 12-10-12; 12-50 – 12-50-11; 12-60 – 12-60-11; 13-00 – 13-00-04; 13-01 – 13-01-06; 13-10 – 13-10-06; 13-11 – 13-11-03; 13-50 – 13-50-01 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:jp1\/netm\/dm_manager:*:*:*:*:*:*:*:* Versions 09-00 – 09-00-14; 09-01 – 09-01-14; 09-10 – 09-10-15; 09-12 – 09-12-16; 09-50 – 09-50-20; 09-51 – 09-51-14; 10-10 – 10-10-25; 10-20 – 10-20-02 Vulnerable ·Hitachi
  • cpe:2.3:a:hitachi:jp1\/netm\/dm_client:*:*:*:*:*:*:*:* Versions 09-00 – 09-00-14; 09-01 – 09-01-14; 09-10 – 09-10-15; 09-12 – 09-12-16; 09-50 – 09-50-20; 09-51 – 09-51-14; 10-10 – 10-10-25; 10-20 – 10-20-02 Vulnerable ·Hitachi

Remediation

  • Fix · CNA JP1/IT Desktop Management 2 - Manager (Hitachi) Fixed in 13-50-02, 13-11-04, 13-10-07, 13-01-07, 13-00-05, 12-60-12
  • Fix · CNA JP1/IT Desktop Management 2 - Operations Director (Hitachi) Fixed in 13-50-02, 13-11-04, 13-10-07, 13-01-07, 13-00-05, 12-60-12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Hitachi JP1/IT Desktop Management 2 - Manager, JP1/IT Desktop Management 2 - Operations Director 12-60-12, 13-00-05 and 4 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-40268 Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DMPriority LOW 24
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-65115
  2. 2026-10-03 Alias added: GHSA-h2gf-w3wm-8xqj
  3. 2026-11-04 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2021-10344 Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution… CVSS 3.1CRITICAL 9.8
  • TI-2013-04118 Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50… CVSS 2.0HIGH 9.0
  • TI-2021-10345 Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API… CVSS 3.1HIGH 7.8
  • TI-2025-40268 Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DM CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences