CVE-2023-5808: System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products are susceptible to unintended information disclosure via unprivileged access to HNAS configuration backup and diagnostic data.
Vulnerability summary
CVE-2023-5808 is a high (CVSS 7.6) Improper Authorization vulnerability in hitachi vantara system management unit (smu). EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities.
Timeline
- 04-12-2023PublishedVulnerability first disclosed.
- 28-08-2024Last modifiedVulnerability information updated.
Description
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative role.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.54% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Hitachi1 product
- vantara_hitachi_network_attached_storage≤ 14.8.7825.01
Hitachi vantara1 product
- system management unit (smu)≥ 6.0, < 14.8.7825.01
2 vendors · 2 products