CVE-2025-1978: hitachi hitachi virtual storage platform e390, e590, e790, e990, e1090, e390h, e590h, e790h, e1090h Code Injection

Vulnerability summary

CVE-2025-1978 is a critical (CVSS 9.8) Code Injection vulnerability in hitachi hitachi virtual storage platform e390, e590, e790, e990, e1090, e390h, e590h, e790h, e1090h. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45% of scored vulnerabilities.

Timeline

1. 07-05-2026
   PublishedVulnerability first disclosed.
2. 07-05-2026
   Last modifiedVulnerability information updated.

Description

Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28. This issue affects Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28  : before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.