CVE-2025-2902
Received Received - Intake

Improper Authorization in Hitachi Virtual Storage Platform

Publication date: 2026-06-29

Last updated on: 2026-06-29

Assigner: Hitachi, Ltd.

Description
Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-29
Last Modified
2026-06-29
Generated
2026-06-29
AI Q&A
2026-06-29
EPSS Evaluated
N/A
NVD
CVE-2025-2902
EUVD
EUVD-2025-210368

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hitachi virtual_storage_platform to 93-07-26-xx/00 (exc)
hitachi virtual_storage_platform to 90-09-27-00/00 (exc)
hitachi virtual_storage_platform to 88-08-16-xx/00 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability, identified as CVE-2025-2902, exists in the management GUI (maintenance utility) of Hitachi Disk Array Systems. It is caused by an improper authorization issue, meaning that the system does not correctly verify user permissions when accessing certain maintenance functions.

The affected products include multiple models of the Hitachi Virtual Storage Platform (VSP) series, such as VSP 5100, 5500, 5200, 5600, VX8, G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, E390, E590, E790, E990, E1090, and their H-series variants.

The recommended permanent fix is to update the microcode to a modified version that addresses this authorization flaw.

Impact Analysis

Because this vulnerability involves improper authorization in the maintenance utility, an attacker with some level of access could potentially perform unauthorized actions on the storage platform.

The CVSS score of 8.3 (High) indicates that the impact includes limited confidentiality loss, high integrity compromise, and high availability disruption, meaning that sensitive data could be exposed or altered, and system availability could be affected.

Mitigation Strategies

The recommended permanent action to mitigate this vulnerability is to replace the microcode with a modified version that includes updated software versions such as DKCMAIN Ver.90-09-27-00/00 and GUM Ver.90-09-27/00.

No interim action is required according to the security advisory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-2902. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart