Hitachi Ops Center Analyzer CVE-2026-3314

Physical access to a device or display rendering the Hitachi Ops Center Analyzer detail view or probe module configuration interface is required. The CVSS vector AV:P explicitly confirms this - remote or network-based exploitation is not possible for this vulnerability. Exploitation is limited to scenarios where an attacker can directly view the screen, such as an unsecured workstation, a shared NOC console, or a shoulder-surfing situation. No authentication is required on the attacker's part (PR:N), meaning any bystander with visual access to the screen can observe the credentials. Exploitation is further constrained to specific UI pages (detail view, probe module config) rather than arbitrary application surfaces. Versions at or above 11.0.8-00 of all three products are not affected.

The overall risk is low-to-moderate for most environments. The CVSS 4.6 score is driven by the physical attack vector (AV:P), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H) with no integrity or availability impact. The physical vector is the dominant risk-limiting factor - an attacker must be physically present at or able to view the screen displaying the vulnerable interface. EPSS at 0.02% and SSVC classification of Exploitation: none and Automatable: no confirm that automated or remote mass exploitation is not viable. Technical impact is rated partial by SSVC, consistent with credential disclosure from a specific UI context rather than full system compromise. No KEV listing and no POC exist. The primary real-world risk is insider threat or shoulder surfing in environments where the Ops Center console is accessible in shared or unsecured physical spaces.

An attacker with physical access to an unattended or shared workstation running the Hitachi Ops Center Analyzer console browses to the detail view or probe module configuration page, where probe or integration credentials are displayed in plaintext rather than masked. The attacker reads or photographs the exposed passwords and uses them to pivot to connected infrastructure components. No exploit code or tooling is required beyond direct UI observation.