Threat database

CVE-2025-65116 is a medium severity buffer overflow vulnerability in multiple versions of Hitachi's JP1/IT Desktop Management 2 - Manager and related products on Windows. The flaw involves the release of invalid pointers or references (CWE-763), which can lead to a denial of service by causing application crashes. The affected versions span multiple releases from 09-00 through 13-50 with various subversions impacted. No known exploits in the wild have been reported, and no official patch or remediation guidance is currently available from the vendor.

CVE-2025-65115 is a high-severity remote code execution vulnerability affecting multiple versions of Hitachi's JP1/IT Desktop Management 2 - Manager and related products on Windows. The issue involves external control of file name or path (CWE-73), which can lead to unauthorized code execution. Affected versions span a wide range of releases from 09-00 through 13-50 with various subversions impacted. The CVSS 3.1 base score is 8.8, indicating a high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits in the wild have been reported.

Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.

Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.

CVE-2025-11158 is a critical vulnerability in Hitachi Vantara Pentaho Data Integration and Analytics versions prior to 10.2.0.6, including 9.3.x and 8.3.x. The flaw arises from missing authorization controls on Groovy scripts embedded in new PRPT reports published by users. This lack of restriction allows attackers with certain privileges to insert arbitrary Groovy scripts, leading to remote code execution (RCE).

Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager.This issue affects Hitachi Ops Center API Configuration Manager: from 10.0.0-00 before 11.0.4-00; Hitachi Configuration Manager: from 8.6.1-00 before 11.0.5-00.

Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijacking.This issue affects Hitachi Ops Center API Configuration Manager: from 10.0.0-00 before 11.0.5-00; Hitachi Configuration Manager: from 8.5.1-00 before 11.0.5-00; Hitachi Device Manager: from 8.4.1-00 before 8.6.5-00.

A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not authorized to do so.

A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.

CVE-2026-1773 is a high-severity vulnerability in the Hitachi Energy RTU500 series CMU firmware affecting versions 12.7.1 through 13.8.1. It involves an incomplete list of disallowed inputs in the IEC 60870-5-104 protocol implementation, which can lead to a denial of service when invalid U-format frames are received. The vulnerability only affects devices configured with IEC 60870-5-104 bi-directional functionality. Enabling secure communication per IEC 62351-3 does not fix the vulnerability but can reduce the risk of exploitation. No official patch or fix is currently indicated in the available data.

RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requires further tools like browser development utilities to access them without required privileges.

Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment.

Cross-site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component) and Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.

Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component) and Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.

Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.

The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute several set-uid (SUID) applications to ultimately gain root access to the TropOS device.

By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a particular set of scripts and executables that allow for certain commands to be run as root from an unprivileged context.

Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.

A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially carrying out further malicious attacks. Performance logging is typically enabled for troubleshooting purposes while resolving application performance related issues.