CVE-2025-9661 - Vulnerability Details - OpenCVE

OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28. This issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00051.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_309.html

History

Thu, 07 May 2026 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 07 May 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28. This issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.
Title		OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23/24/26/28
Weaknesses		CWE-78
References		https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_309.html
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Hitachi

Published: 2026-05-07T07:08:14.823Z

Updated: 2026-05-07T13:02:35.204Z

Reserved: 2025-08-29T07:14:42.691Z

Link: CVE-2025-9661

Vulnrichment

Updated: 2026-05-07T13:02:22.155Z

NVD

Status : Received

Published: 2026-05-07T08:16:00.317

Modified: 2026-05-07T08:16:00.317

Link: CVE-2025-9661

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-05-07T08:30:25Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9661", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "state": "PUBLISHED", "assignerShortName": "Hitachi", "dateReserved": "2025-08-29T07:14:42.691Z", "datePublished": "2026-05-07T07:08:14.823Z", "dateUpdated": "2026-05-07T13:02:35.204Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2026-05-07T07:08:14.823Z"}, "title": "OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23/24/26/28", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 23", "versions": [{"status": "affected", "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 24", "versions": [{"status": "affected", "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 26", "versions": [{"status": "affected", "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 28", "versions": [{"status": "affected", "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28.\n\nThis issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28.</div><div><span>This issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.</span></div>"}]}], "references": [{"url": "https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_309.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"advisory": "hitachi-sec-2026-309", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-07T13:02:14.993613Z", "id": "CVE-2025-9661", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T13:02:35.204Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9661", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T13:02:14.993613Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T13:02:22.155Z"}}], "cna": {"title": "OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23/24/26/28", "source": {"advisory": "hitachi-sec-2026-309", "discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 23", "versions": [{"status": "affected", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 24", "versions": [{"status": "affected", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 26", "versions": [{"status": "affected", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 28", "versions": [{"status": "affected", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_309.html"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28.\n\nThis issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.", "supportingMedia": [{"type": "text/html", "value": "<div>OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28.</div><div><span>This issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.</span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"}]}], "providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2026-05-07T07:08:14.823Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9661", "state": "PUBLISHED", "dateUpdated": "2026-05-07T13:02:35.204Z", "dateReserved": "2025-08-29T07:14:42.691Z", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "datePublished": "2026-05-07T07:08:14.823Z", "assignerShortName": "Hitachi"}, "dataVersion": "5.2"}