This vulnerability (CVE-2025-1978) involves improper control of code generation (CWE-94) in Hitachi Virtual Storage Platform models G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, and others, including various E-series and One Block models. It allows remote code execution via Hitachi Storage Navigator and maintenance consoles on affected versions prior to specified firmware releases. The vulnerability enables an unauthenticated attacker to execute arbitrary code remotely, potentially compromising confidentiality, integrity, and availability of the affected systems. The CVSS 3.1 base score is 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L), reflecting a high-severity network-based attack with significant impact. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on affected Hitachi Virtual Storage Platforms without authentication. This could lead to unauthorized disclosure of information, modification of data, and disruption of service availability. The vulnerability affects confidentiality, integrity, and availability, making it a critical risk for environments relying on these storage systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to management interfaces of affected Hitachi Virtual Storage Platforms and monitor for unusual activity. Follow vendor communications closely for updates on patches or mitigations.