dbcve.org
Virtual Storage One BlockApplication · Hitachi

CVE-2025-1978

CRITICAL · 9.8 CVSS v3.1 Published 2026-05-07
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28. This issue affects Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H, Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26, One Block 28  : before DKCMAIN Ver. 88-08-16-xx/00, SVP Ver. 88-08-18-xx/00, before DKCMAIN Ver. 93-07-26-xx/00, SVP Ver. 93-07-26-xx/00, before DKCMAIN Ver. A3-04-02-xx/00, MPC Ver. A3-04-02-xx/00, before DKCMAIN Ver. A3-03-41-xx/00, MPC Ver. A3-03-41-xx/00, before DKCMAIN Ver. A3-03-03-xx/00, MPC Ver. A3-03-03-xx/00.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

A Remote Code Execution vulnerability exists in Hitachi Storage Navigator and the maintenance console across multiple Virtual Storage Platform models. The vulnerability affects specific versions of DKCMAIN, SVP, and MPC firmware components. Successful exploitation allows attackers to execute arbitrary code on affected storage systems.

MitigationUpdate affected systems to the specified DKCMAIN, SVP, and MPC firmware versions (88-08-16-xx/00 or later for G-series, 93-07-26-xx/00 or later for F-series, A3-04-02-xx/00 or later for E-series models).

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Virtual Storage One BlockApplication
Affected:= 23= 24= 26= 28
Vsp G130 FirmwareOperating system
Affected:all versions
Vsp G150 FirmwareOperating system
Affected:all versions
Vsp G350 FirmwareOperating system
Affected:all versions
Vsp G370 FirmwareOperating system
Affected:all versions
Vsp G700 FirmwareOperating system
Affected:all versions
Vsp G900 FirmwareOperating system
Affected:all versions
Vsp F350 FirmwareOperating system
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the storage system model
    Access the system management interface or storage array and retrieve the model name (e.g., VSP G130, VSP G350, Virtual Storage One Block)
    Affected if The model is any of the following: VSP G130, G150, G350, G370, G700, G900, VSP F350, or Virtual Storage One Block (versions 23, 24, 26, or 28)
  2. Check the DKCMAIN firmware version
    Use the storage management CLI or GUI to query the DKCMAIN firmware version installed on the system
    Affected if The installed version is below 88-08-16-xx/00 (for G-series models) or below 93-07-26-xx/00 (for F-series models), or for Virtual Storage One Block if the version is 23, 24, 26, or 28 regardless of the patch level
  3. Check the SVP firmware version
    Query the SVP (Service Processor) firmware version through the maintenance console or management interface
    Affected if The SVP firmware version is below the specified fixed versions for the respective model family
  4. Check the MPC firmware version
    Query the MPC (Micro Processor Controller) firmware version via the storage system maintenance interface
    Affected if The MPC firmware version is below the specified fixed versions for the respective model family
  5. Verify if Storage Navigator or maintenance console is exposed
    Check network configuration to determine if the Storage Navigator GUI or maintenance console is accessible from network segments outside the management zone
    Affected if The management interfaces are exposed to untrusted network segments, increasing the exploitability of this RCE vulnerability

A system is affected if it is any of the listed VSP models (including Virtual Storage One Block versions 23/24/26/28) and is running firmware versions older than the fixed releases for DKCMAIN, SVP, and MPC components.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Update affected systems to the specified DKCMAIN, SVP, and MPC firmware versions (88-08-16-xx/00 or later for G-series, 93-07-26-xx/00 or later for F-series, A3-04-02-xx/00 or later for E-series models).

Recommended fix High confidence

Upgrade to DKCMAIN/SVP/MPC firmware versions 88-08-16-xx/00 or later for G130/G150/F350; 93-07-26-xx/00 or later for G350/G370/G700/G900; A3-04-02-xx/00 or later for E series models; or A3-03-41-xx/00 or later for VSP One Block

  1. 1. Identify the specific Hitachi Virtual Storage Platform model and current firmware version installed.
  2. 2. Consult Hitachi's official support documentation to determine the exact firmware version required for your model.
  3. 3. Download the appropriate firmware update from Hitachi's official support portal (support.hitachi-vantara.com) or contact Hitachi support directly.
  4. 4. Schedule a maintenance window as firmware updates may require system downtime.
  5. 5. Follow Hitachi's documented firmware upgrade procedure for your specific storage model.
  6. 6. Verify the firmware version has been successfully updated by checking DKCMAIN, SVP, or MPC versions as applicable.
  7. 7. Confirm the vulnerability is resolved by verifying the new firmware version meets or exceeds the fixed versions: DKCMAIN 88-08-16-xx/00, SVP 88-08-18-xx/00, DKCMAIN 93-07-26-xx/00, SVP 93-07-26-xx/00, DKCMAIN A3-04-02-xx/00, MPC A3-04-02-xx/00, DKCMAIN A3-03-41-xx/00, MPC A3-03-41-xx/00, DKCMAIN A3-03-03-xx/00, or MPC A3-03-03-xx/00.
Caveat Firmware upgrades on storage systems may require planned downtime and should be performed according to Hitachi's documented procedures; ensure proper backups and cluster failover preparations are in place

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Virtual Storage One Block Scoped from the published advisory
  • Consultation8.0 h
  • Implementation16.0 h
  • Testing12.0 h
  • Review / QA8.0 h
44.0 hours of engineering $7,720
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $12,352.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-1978 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-1978 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data