Ops Center Analyzer CVE-2025-66444

Exploitation requires (1) valid authenticated access to Hitachi Ops Center Analyzer or Infrastructure Analytics Advisor at low privilege (PR:L) to inject the payload, and (2) a victim user with an active session to view the affected 'Analyzer detail view' / Data Center Analytics component content, satisfying the user-interaction requirement (UI:R). Exploitation is limited to deployments running Hitachi Ops Center Analyzer versions 10.0.0-00 up to (but not including) 11.0.5-00; environments already on 11.0.5-00 or later are not affected. The dual gate of required authentication plus required victim interaction is the key limiting factor and means this cannot be triggered by an unauthenticated remote attacker against a default configuration.

This is a stored/reflected cross-site scripting flaw (CWE-79) carrying a vendor CVSS 3.1 score of 8.2, elevated primarily by the scope-change flag (S:C) that is typical for XSS where injected script executes in a victim's browser context outside the vulnerable application's boundary. The vendor vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) indicates a network-reachable but authenticated (PR:L) attacker who must lure a victim into interacting (UI:R). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis. The combination of required low-privilege authentication AND required user interaction materially lowers real-world risk below what the 8.2 base score suggests - this is a high-CVSS issue whose exploitation is gated by two independent prerequisites rather than a drive-by unauthenticated RCE. The vendor-assigned C:H is also notably aggressive for XSS; typical XSS confidentiality impact is Low unless session hijacking of a high-privilege operator is demonstrated, so this rating should be verified against the Hitachi advisory. Net assessment: a genuine but moderate-priority vulnerability - patch in normal cycles rather than emergency, given the authentication gate, the UI requirement, and the absence of any exploitation or POC signal.

An authenticated low-privilege user of Hitachi Ops Center Analyzer injects a malicious script payload into a field rendered by the Analyzer detail view component. When a higher-privileged administrator later opens that view, the script executes in the admin's browser session, enabling session token theft or unauthorized actions performed as the victim. No public exploit code is known, and the attack requires both valid credentials and victim interaction.