CVE-2025-1978

Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console

High8.3EPSS 0.55%

Published: 7 May 2026
Updated: 7 May 2026
Reserved: 5 Mar 2025
Assigned by: Hitachi

Description

Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28. This issue affects Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 : before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00.

Scores

CVSS scores of CVE-2025-1978, by who scored it
Scored by	CVSS	Score	Vector
HitachiCNA (assigner)	3.1	High8.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
NVDNVD · Analyzed	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.55% · top 54% of all CVEs (4 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.

Weakness

CWE-94 Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

Hitachi · Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900
- affected < DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00
- affected < DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00
- affected < DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00
- affected < DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00
- affected < DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00
Hitachi · Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H
- affected < DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00
- affected < DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00
- affected < DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00
- affected < DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00
- affected < DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00
Hitachi · Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28
- affected < DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00
- affected < DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00
- affected < DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00
- affected < DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00
- affected < DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00

References (1)

https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_307.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-1978](https://trackcve.app/badge/CVE-2025-1978.svg)](https://trackcve.app/cve/CVE-2025-1978)

Record last updated 7 May 2026, 13:40 UTC.