{"id":"CVE-2025-2902","state":"PUBLISHED","title":"Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform","description":"Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform.\n\nThis issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00.","publishedAt":"2026-06-29T05:52:39.570Z","updatedAt":"2026-06-29T12:40:09.069Z","severity":{"score":8.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","source":"Hitachi"},"assigner":"Hitachi","products":["Hitachi Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H","Hitachi Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H","Hitachi Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900"],"affected":[{"vendor":"Hitachi","product":"Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00","changes":[{"at":"DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00","status":"unaffected"}],"versionType":"custom"}]},{"vendor":"Hitachi","product":"Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00","changes":[{"at":"DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00","status":"unaffected"}],"versionType":"custom"}]},{"vendor":"Hitachi","product":"Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00","changes":[{"at":"DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00","status":"unaffected"}],"versionType":"custom"}]}],"references":["https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_305.html"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2902.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-2902","state":"PUBLISHED","datePublished":"2026-06-29T05:52:39.570Z","dateUpdated":"2026-06-29T12:40:09.069Z","assignerShortName":"Hitachi","assignerOrgId":"50d0f415-c707-4733-9afc-8f6c0e9b3f82","dateReserved":"2025-03-28T06:25:15.368Z"},"containers":{"cna":{"title":"Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform","descriptions":[{"lang":"en","value":"Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform.\n\nThis issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00."}],"affected":[{"vendor":"Hitachi","product":"Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00","changes":[{"at":"DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00","status":"unaffected"}],"versionType":"custom"}]},{"vendor":"Hitachi","product":"Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00","changes":[{"at":"DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00","status":"unaffected"}],"versionType":"custom"}]},{"vendor":"Hitachi","product":"Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00","changes":[{"at":"DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00","status":"unaffected"}],"versionType":"custom"}]}],"references":[{"url":"https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_305.html","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862 Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"Hitachi","orgId":"50d0f415-c707-4733-9afc-8f6c0e9b3f82","dateUpdated":"2026-06-29T05:52:39.570Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"source":{"advisory":"hitachi-sec-2026-305","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-29T12:39:47.151090Z","id":"CVE-2025-2902","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-29T12:40:09.069Z"}}]}}}