CVE-2025-1978: Hitachi Storage Navigator RCE Vulnerability

CVE-2025-1978 Overview

CVE-2025-1978 is a remote code execution vulnerability affecting Hitachi Storage Navigator and the maintenance console across multiple Hitachi Virtual Storage Platform (VSP) product lines. The flaw is classified under CWE-94: Improper Control of Generation of Code, indicating a code injection weakness in the management interfaces of these enterprise storage systems.

The vulnerability impacts the VSP G-series, F-series, E-series, and One Block models. An unauthenticated attacker with network access to the management plane can exploit the issue without user interaction.

Critical Impact

Remote attackers can execute arbitrary code against Hitachi VSP management interfaces over the network with no authentication or user interaction, potentially compromising storage administration and downstream data availability.

Affected Products

• Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900 and F350, F370, F700, F900 before DKCMAIN Ver. 88-08-16-xx/00 and SVP Ver. 88-08-18-xx/00
• Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H before DKCMAIN Ver. 93-07-26-xx/00 and SVP Ver. 93-07-26-xx/00
• Hitachi Virtual Storage Platform One Block 23, 24, 26, 28 before DKCMAIN Ver. A3-04-02-xx/00, A3-03-41-xx/00, and A3-03-03-xx/00 with corresponding MPC versions

Discovery Timeline

• 2026-05-07 - CVE-2025-1978 published to the National Vulnerability Database
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2025-1978

Vulnerability Analysis

The vulnerability resides in Hitachi Storage Navigator and the maintenance console used to administer Virtual Storage Platform arrays. These components are exposed on the management network and accept input from operators performing configuration and diagnostic tasks. The flaw allows that input to influence code generation or evaluation paths within the management application.

Because the issue maps to CWE-94, the root mechanism is improper control over code generation. Attacker-supplied data crosses a trust boundary and is interpreted as executable logic rather than treated strictly as data. Successful exploitation yields remote code execution in the context of the management service.

The attack scope is changed, meaning compromise of the management component can affect resources beyond it. This includes the ability to manipulate storage configuration, alter logical device mappings, or disrupt array availability across tenants relying on the affected VSP.

Root Cause

The management interfaces fail to constrain user-controllable inputs before those inputs reach a code interpreter or dynamic execution sink. Without strict input validation and output encoding, crafted requests reach a path that compiles or evaluates the supplied content as part of the application logic.

Attack Vector

The attack vector is network-based with low attack complexity. The attacker requires no privileges and no user interaction. An adversary with reachability to the Storage Navigator web interface or the maintenance console can deliver a crafted request that triggers the code injection condition.

No verified public exploit code or proof-of-concept is available at the time of publication. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Hitachi Security Information 2026 advisory for vendor technical details.

Detection Methods for CVE-2025-1978

Indicators of Compromise

• Unexpected child processes or shell invocations spawned by Storage Navigator or maintenance console service accounts
• Anomalous outbound connections originating from the Service Processor (SVP) or Management Processor (MPC) hosts
• New or modified scripts, binaries, or scheduled tasks on management hosts that administer VSP arrays

Detection Strategies

• Inspect web access and audit logs on Storage Navigator and the maintenance console for malformed parameters, unusually long payloads, or unexpected encoded content
• Compare running DKCMAIN, SVP, and MPC firmware versions against the fixed versions listed in the Hitachi advisory and flag any deployments below those thresholds
• Alert on configuration changes to logical devices, host groups, or user accounts that occur outside change windows

Monitoring Recommendations

• Centralize logs from VSP management interfaces and correlate authentication, configuration, and process events
• Monitor north-south and east-west traffic to and from the storage management VLAN for connections from non-administrative subnets
• Track integrity of management host filesystems and binaries with file integrity monitoring

How to Mitigate CVE-2025-1978

Immediate Actions Required

• Identify all VSP G, F, E, and One Block arrays in scope and inventory their DKCMAIN, SVP, and MPC firmware versions
• Restrict network reachability to Storage Navigator and the maintenance console to dedicated administrative jump hosts
• Rotate credentials used by storage administrators if exposure of the management plane is suspected

Patch Information

Apply the fixed firmware versions referenced in the Hitachi Security Information 2026 advisory. For VSP G/F-series upgrade to DKCMAIN Ver. 88-08-16-xx/00 and SVP Ver. 88-08-18-xx/00 or later. For VSP E-series upgrade to DKCMAIN Ver. 93-07-26-xx/00 and SVP Ver. 93-07-26-xx/00 or later. For VSP One Block models upgrade to the corresponding A3-04-02-xx/00, A3-03-41-xx/00, or A3-03-03-xx/00 firmware lines per model.

Workarounds

• Place the management network behind a firewall that permits only authorized administrator source addresses
• Disable or limit access to the maintenance console when not required for active service operations
• Enforce multi-factor authentication on jump hosts used to reach Storage Navigator until firmware updates are deployed

# Example: restrict access to Storage Navigator management interface
# Replace SVP_IP and ADMIN_SUBNET with environment-specific values
iptables -A INPUT -p tcp -s ADMIN_SUBNET -d SVP_IP --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -d SVP_IP --dport 443 -j DROP