What is the CVSS score of CVE-2025-2902?

CVE-2025-2902 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2025-2902?

Within 24 hours: Inventory all Hitachi VSP systems in your environment and document current DKCMAIN/GUM firmware versions to identify affected assets. Within 7 days: Contact Hitachi support for available firmware updates; immediately restrict maintenance utility access to only required administrators and disable low-privileged user access where possible; implement audit logging for all maintenance operations. Within 30 days: Deploy vendor-released firmware patches as they become available; implement least-privilege access controls for storage administration; conduct security assessment of storage controller access policies across all VSP instances.

Hitachi Virtual Storage Platform G130 G150 G350 G370 G700 G900 F350 F370 F700 F900 CVE-2025-2902

EUVD-2025-210368 HIGH

Missing Authorization (CWE-862)

2026-06-29 Hitachi

GHSA-3mc2-p59g-jpp4

Authentication Bypass Hitachi Virtual Storage Platform G130 G150 G350 G370 G700 G900 F350 F370 F700 F900 Hitachi Virtual Storage Platform E390 E590 E790 E990 E1090 E390H E590H E790H E1090H Hitachi Virtual Storage Platform 5100 5500 5100H 5500H 5200 5600 5200H 5600H Hitachi

8.3

CVSS 3.1 · Vendor: Hitachi

Severity by source

Vendor (Hitachi) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Primary rating from Vendor (Hitachi) · only source for this CVE.

CVSS VectorVendor: Hitachi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 07:17 vuln.today

DescriptionCVE.org

Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform.

This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00.

AnalysisAI

Improper authorization in the Maintenance Utility of Hitachi Virtual Storage Platform (VSP) enterprise storage arrays allows an authenticated low-privileged user to perform actions beyond their authorization, undermining the integrity and availability of the storage controller. The flaw affects the VSP E-series, VSP 5000-series, and VSP G/F-series families running pre-fix DKCMAIN and GUM firmware, and was reported by Hitachi itself; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.