Hitachi VSP Management Interface Insecure Authorization Vulnerability (CVE-2025-2902)

Vulnerability Overview Vulnerability ID: hitachi-sec-2026-305 CVE ID: CVE-2025-2902 Description: A vulnerability exists in the management interface (maintenance tool) of Hitachi Disk Array Systems, involving improper authorization controls. Affected Products Affected Products: - Hitachi Virtual Storage Platform S100, S500, S100H, S500H - Hitachi Virtual Storage Platform S200, S500, S200H, S500H - Hitachi Virtual Storage Platform V8F - Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 - Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H Remediation Permanent Action: Replace with modified microcode. - Software Versions: - DRKMAIN Ver: 90-09-27-00/00, GUM Ver: 90-09-27/00 - DRKMAIN Ver: 88-08-10-xx/00, GUM Ver: 88-08-20/00 - DRKMAIN Ver: 93-07-20-xx/00, GUM Ver: 93-07-20/00 Temporary Action: None Additional Information Release Date: March 27, 2026 Publisher: Hitachi, Ltd. and Hitachi Vantara, Ltd. Notes The page provides accurate information regarding security countermeasures, but the content may change due to modifications by non-Hitachi software developers. The page link was valid at the time of publication, but its long-term availability cannot be guaranteed. Trademarks such as VMware, Docker, and Microsoft are mentioned. POC Code or Exploit Code The page does not contain POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Hitachi VSP Management Interface Insecure Authorization Vulnerability (CVE-2025-2902)