CVE-2025-9661: Hitachi VSP One Block RCE Vulnerability

CVE-2025-9661 Overview

CVE-2025-9661 is an operating system (OS) command injection vulnerability in the management graphical user interface (GUI) maintenance utility of Hitachi Virtual Storage Platform One Block. The flaw affects models 23, 24, 26, and 28 running firmware before DKCMAIN A3-04-21-40/00 and ESM A3-04-21/00. The weakness is classified under [CWE-78], which covers improper neutralization of special elements used in an OS command. Successful exploitation allows an attacker to execute arbitrary OS commands on the storage controller through the network-accessible management interface.

Critical Impact

Network-based command injection against an enterprise storage controller can compromise the confidentiality, integrity, and availability of data hosted on the affected Hitachi VSP One Block arrays.

Affected Products

• Hitachi Virtual Storage Platform One Block 23 before DKCMAIN A3-04-21-40/00 / ESM A3-04-21/00
• Hitachi Virtual Storage Platform One Block 24 and 26 before DKCMAIN A3-04-21-40/00 / ESM A3-04-21/00
• Hitachi Virtual Storage Platform One Block 28 before DKCMAIN A3-04-21-40/00 / ESM A3-04-21/00

Discovery Timeline

• 2026-05-07 - CVE-2025-9661 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2025-9661

Vulnerability Analysis

The vulnerability resides in the maintenance utility exposed by the management GUI of Hitachi Virtual Storage Platform One Block arrays. The utility constructs OS commands using attacker-influenced input without sufficient neutralization of shell metacharacters. An attacker who can reach the management interface over the network can inject additional commands that the underlying operating system executes with the privileges of the maintenance utility process.

The issue is tracked under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command). Exploitation does not require authentication or user interaction, although the attack complexity is rated high, indicating that specific conditions or timing may be needed to trigger the injection reliably. Successful exploitation can yield full read, write, and disruption capabilities against the storage controller.

Root Cause

The root cause is a failure to sanitize input before passing it to an OS command interpreter within the maintenance utility component of the management GUI. When the utility builds command strings, attacker-supplied data is concatenated into shell invocations rather than passed as discrete arguments. Shell metacharacters such as ;, |, &, and backticks therefore alter the intended command structure.

Attack Vector

The attack vector is the network-exposed management GUI of the affected VSP One Block models. An attacker sends a crafted request to the maintenance utility endpoint with payload data containing embedded shell commands. The vulnerable component executes the injected commands on the storage controller's operating system. Hitachi's advisory in Hitachi Security Information 2026 describes the affected component and fixed firmware versions. No public proof-of-concept exploit is currently associated with this CVE.

Detection Methods for CVE-2025-9661

Indicators of Compromise

• Unexpected child processes spawned by the maintenance utility or management GUI service on VSP One Block controllers.
• Outbound network connections from storage controllers to unfamiliar hosts following management GUI activity.
• New or modified files, scripts, or scheduled tasks on the controller that were not introduced through authorized maintenance procedures.

Detection Strategies

• Monitor management GUI access logs for unusual request parameters containing shell metacharacters such as ;, |, &&, $(), or backticks.
• Correlate authentication events on the storage management interface with subsequent process execution and configuration changes on the controller.
• Alert on requests to maintenance utility endpoints originating from IP ranges outside the documented administrative network.

Monitoring Recommendations

• Forward Hitachi VSP One Block syslog and audit data to a centralized SIEM for retention and correlation.
• Baseline normal maintenance utility usage patterns and flag deviations in request volume, source, or payload structure.
• Inspect network flows to and from the storage controller management interface for anomalous protocols or destinations.

How to Mitigate CVE-2025-9661

Immediate Actions Required

• Upgrade affected VSP One Block 23, 24, 26, and 28 systems to firmware DKCMAIN A3-04-21-40/00 and ESM A3-04-21/00 or later.
• Restrict network access to the management GUI to a dedicated, isolated administrative VLAN with strict access control lists.
• Audit existing storage controllers for evidence of unauthorized command execution prior to patching.

Patch Information

Hitachi has released fixed firmware. Apply DKCMAIN A3-04-21-40/00 and ESM A3-04-21/00 or later on all affected VSP One Block 23, 24, 26, and 28 systems. Refer to the Hitachi Security Information 2026 advisory for complete remediation guidance and version mapping.

Workarounds

• Place the management GUI behind a jump host or bastion that enforces multi-factor authentication for administrators.
• Block network access to the maintenance utility from any source other than authorized management workstations using firewall rules.
• Disable or limit use of the maintenance utility until firmware can be applied, where operationally feasible.