CVE-2025-9661

OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28. This issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_309.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hitachi:virtual_storage_one_block:23:::::::*
	cpe:2.3:a:hitachi:virtual_storage_one_block:24:::::::*
	cpe:2.3:a:hitachi:virtual_storage_one_block:26:::::::*
	cpe:2.3:a:hitachi:virtual_storage_one_block:28:::::::*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de inyección de comandos del SO en la GUI de gestión (utilidad de mantenimiento) de Hitachi Virtual Storage Platform One Block 23, 24, 26 y 28. Este problema afecta a Hitachi Virtual Storage Platform One Block 23/24/26/28: antes de DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.

Information

Published : 2026-05-07 08:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-9661

Mitre link : CVE-2025-9661

CVE.ORG link : CVE-2025-9661

JSON object : View

Products Affected

hitachi

virtual_storage_one_block

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-9661", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9661", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T13:02:14.993613Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "hirt@hitachi.co.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "hirt@hitachi.co.jp", "affectedData": [{"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 23", "versions": [{"status": "affected", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 24", "versions": [{"status": "affected", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 26", "versions": [{"status": "affected", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Virtual Storage Platform One Block 28", "versions": [{"status": "affected", "changes": [{"at": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "status": "unaffected"}], "version": "0", "lessThan": "DKCMAIN A3-04-21-40/00, ESM A3-04-21/00", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T08:16:00.317", "references": [{"url": "https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_309.html", "tags": ["Vendor Advisory"], "source": "hirt@hitachi.co.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "hirt@hitachi.co.jp", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28.\n\nThis issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de comandos del SO en la GUI de gesti\u00f3n (utilidad de mantenimiento) de Hitachi Virtual Storage Platform One Block 23, 24, 26 y 28.\n\nEste problema afecta a Hitachi Virtual Storage Platform One Block 23/24/26/28: antes de DKCMAIN A3-04-21-40/00, ESM A3-04-21/00."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hitachi:virtual_storage_one_block:23:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46788D83-153E-42CF-ACA5-09506AA45D54"}, {"criteria": "cpe:2.3:a:hitachi:virtual_storage_one_block:24:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC7E00FD-2148-457B-B91A-FDB575DF8DF7"}, {"criteria": "cpe:2.3:a:hitachi:virtual_storage_one_block:26:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04B799D3-FCF2-4832-8E5D-65D5BE53F47D"}, {"criteria": "cpe:2.3:a:hitachi:virtual_storage_one_block:28:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC55432F-8451-4859-A01A-946C26A793C6"}], "operator": "OR"}]}], "sourceIdentifier": "hirt@hitachi.co.jp"}