What is the CVSS score of CVE-2025-0824?

CVE-2025-0824 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Hitachi VSP One Block CVE-2025-0824

EUVD-2025-210367 LOW

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-29 Hitachi

GHSA-vc2c-7fwx-x7mr

Jwt Attack Information Disclosure Hitachi Virtual Storage Platform One Block 23 24 26 28

3.7

CVSS 3.1 · Vendor: Hitachi

Severity by source

Vendor (Hitachi) PRIMARY

3.7 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.7 LOW

Network-accessible management plane, but high complexity to forge firmware signing token; authenticated and interactive update required; no confidentiality impact confirmed in description.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Hitachi).

CVSS VectorVendor: Hitachi

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 07:16 vuln.today

DescriptionCVE.org

Lack of validation for firmware update in Hitachi Hitachi Virtual Storage Platform One Block 23, 24, 26, 28.

This issue affects Hitachi Virtual Storage Platform One Block 23, 24, 26, 28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.

AnalysisAI

Firmware update signature bypass in Hitachi Virtual Storage Platform One Block models 23, 24, 26, and 28 allows an authenticated remote attacker to supply unvalidated firmware packages, potentially compromising storage array integrity and availability. The root cause is CWE-347 (Improper Verification of Cryptographic Signature), and the 'Jwt Attack' tag suggests the firmware validation chain relies on a JWT-based signing mechanism that can be circumvented under specific conditions. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the self-disclosure by Hitachi with a coordinated patch release indicates vendor-confirmed severity.

Technical ContextAI

CWE-347 describes a failure to properly verify cryptographic signatures before trusting and acting on signed data. In this context, the affected firmware update subsystem of Hitachi VSP One Block (CPE: cpe:2.3:a:hitachi:hitachi_virtual_storage_platform_one_block_23,_24,_26,_28:*:*:*:*:*:*:*:*) does not rigorously validate the cryptographic signature or token (likely JWT-based, per the 'Jwt Attack' tag) accompanying a firmware package prior to applying it. Enterprise storage controllers typically gate firmware installations behind a signed manifest; a flaw in this gate allows crafted or forged update packages to bypass integrity checks. The vulnerability spans both the DKCMAIN disk controller firmware and ESM (Environmental Service Module) firmware components, indicating the validation gap exists across multiple update paths on the same platform.

RemediationAI

Upgrade Hitachi Virtual Storage Platform One Block models 23, 24, 26, and 28 to DKCMAIN firmware version A3-04-21-40/00 and ESM firmware version A3-04-21/00 or later, per the Hitachi security advisory at https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_308.html. As compensating controls pending patching, restrict access to the storage management interface to trusted administrator accounts only, enforce network segmentation so the management plane is not reachable from general corporate or untrusted networks, and audit firmware update activity logs for any unexpected update attempts. Disabling or tightly controlling who can initiate firmware update workflows reduces the PR:L + UI:R exploitation surface significantly. Note that network segmentation alone does not eliminate the risk if insider or compromised-credential scenarios are in scope.