Critical severity · published May 7, 2026
CVE-2025-1978
Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28.
This issue affects Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 : before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HV
Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H · Hitachi
before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 · source: vendor
HV
Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 · Hitachi
before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 · source: vendor
HV
Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28 · Hitachi
before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00; before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00; before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00; before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00; before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00 · source: vendor
VS
Virtual Storage One Block · Hitachi
23; 24; 26; 28 · source: NVD
VE
Vsp E1090 Firmware · Hitachi
All versions, or not specified · source: NVD
VE
Vsp E1090h Firmware · Hitachi
All versions, or not specified · source: NVD
VE
Vsp E390 Firmware · Hitachi
All versions, or not specified · source: NVD
VE
Vsp E390h Firmware · Hitachi
All versions, or not specified · source: NVD
VE
Vsp E590 Firmware · Hitachi
All versions, or not specified · source: NVD
VE
Vsp E590h Firmware · Hitachi
All versions, or not specified · source: NVD
VE
Vsp E790 Firmware · Hitachi
All versions, or not specified · source: NVD
VE
Vsp E790h Firmware · Hitachi
All versions, or not specified · source: NVD
Affected product
HV
Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H
Hitachi
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1978
Vendor Advisory
https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_307.html
More from Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H
8.3
CVE-2025-2902
Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform
5.3
CVE-2025-2514
Improper Restriction of Excessive Authentication Attempts vulnerability in Hitachi Virtual Storage Platform