What is the CVSS score of EUVD-2025-209257?

EUVD-2025-209257 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2025-209257?

Yes, a patch is available for EUVD-2025-209257. Update the affected software to the latest version immediately.

Jp1 It Desktop Management 2 Manager EUVD-2025-209257

| CVE-2025-65116 MEDIUM

Release of Invalid Pointer or Reference (CWE-763)

2026-04-07 Hitachi

Buffer Overflow Microsoft Jp1 It Desktop Management 2 Manager Jp1 It Desktop Management 2 Operations Director Job Management Partner 1 It Desktop Management 2 Manager Jp1 It Desktop Management Manager Job Management Partner 1 It Desktop Management Manager Jp1 Netm Dm Manager Jp1 Netm Dm Client Job Management Partner 1 Software Distribution Manager Job Management Partner 1 Software Distribution Client Hitachi

5.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-763 ASVS 5.0 V15 - Secure Coding and Architecture Pointer release safety
Impact	The CVSS 5.5 score with AV:L (local only) significantly limits real-world exploitability compared to network-accessible flaws. The authentication requirement (PR:L) further restricts the threat model to users with valid local accounts. However, the CVSS impact vector shows A:H (availability is fully impacted), meaning successful exploitation causes complete denial of service. The local + low-complexity attack vector suggests this could be triggered through routine user actions (e.g., processing malformed configuration files, interacting with shared resources). For enterprises deploying JP1/IT Desktop Management as a centralized IT operations platform, compromise of manager components could disrupt desktop management operations across many endpoints. The lack of KEV or POC confirmation indicates this is not yet in active exploitation, reducing immediate priority but warranting standard patch management cycles. Organizations with these products should prioritize based on deployment scope and business continuity impact of manager/distribution service downtime.
Exploit ScenarioDerived	A local user with standard privileges on a Windows system running JP1/IT Desktop Management Manager crafts a malformed configuration file or sends a specially constructed inter-process message to the manager service. The buffer overflow in input validation code is triggered, causing the manager process to crash and denying service to all dependent desktop management operations across connected client systems. Alternatively, an authenticated user with access to shared file paths monitored by the distribution client could upload a crafted file that triggers the overflow when processed, disrupting software distribution workflows. No public exploit code has been identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 07, 2026

Buffer overflow in Hitachi JP1/IT Desktop Management suite and Job Management Partner 1 software on Windows allows local authenticated users to cause denial of service by triggering memory corruption in affected manager and client components. The vulnerability spans multiple product lines and versions, with CVSS 5.5 indicating moderate local attack surface; active exploitation status not confirmed.

RemediationAI

Update to patched versions: JP1/IT Desktop Management 2 Manager/Operations Director to 13-50-02, 13-11-04, 13-10-07, 13-01-07, 13-00-05, or 12-60-12 depending on your current version; Job Management Partner 1/IT Desktop Management 2 Manager to 10-50-12 or later; JP1/IT Desktop Management Manager/Job Management Partner 1/IT Desktop Management Manager to 10-10-17 or later; JP1/NETM/DM Manager/Client to 10-20-03 or later; Job Management Partner 1/Software Distribution Manager/Client to 09-51-14 or later. Organizations should consult the Hitachi security advisory at https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-118/ for exact patch availability dates and detailed update procedures. Given the local-only attack vector, prioritize updating systems that support shared logins or host untrusted users; manager components should be updated first to prevent potential cascading impact on managed endpoints.

Affected VersionsENISA

Job Management Partner 1/IT Desktop Management 2 - Manager 10-50 ≤10-50-11

Job Management Partner 1/Software Distribution Manager 09-00 ≤09-51-13

JP1/IT Desktop Management 2 - Operations Director 13-00 <13-00-05

JP1/IT Desktop Management 2 - Operations Director 12-60 <12-60-12

JP1/IT Desktop Management - Manager 09-50 ≤10-10-16

JP1/IT Desktop Management 2 - Manager 13-11 <13-11-04

Job Management Partner 1/Software Distribution Client 09-00 ≤09-51-13

JP1/IT Desktop Management 2 - Operations Director 10-50 ≤12-50-11

JP1/IT Desktop Management 2 - Operations Director 13-50 <13-50-02

JP1/IT Desktop Management 2 - Operations Director 13-01 <13-01-07

JP1/IT Desktop Management 2 - Operations Director 13-10 <13-10-07

JP1/IT Desktop Management 2 - Manager 13-01 <13-01-07

JP1/IT Desktop Management 2 - Manager 13-50 <13-50-02

JP1/NETM/DM Manager 09-00 ≤10-20-02

JP1/IT Desktop Management 2 - Operations Director 13-11 <13-11-04

JP1/IT Desktop Management 2 - Manager 10-50 ≤12-50-11

JP1/IT Desktop Management 2 - Manager 13-10 <13-10-07

JP1/IT Desktop Management 2 - Manager 12-60 <12-60-12

JP1/NETM/DM Client 09-00 ≤10-20-02

Job Management Partner 1/IT Desktop Management - Manager 09-50 ≤10-10-16

JP1/IT Desktop Management 2 - Manager 13-00 <13-00-05

Affected Packages

euvd job_management_partner_1_it_desktop_management_2_manager no fix

euvd job_management_partner_1_it_desktop_management_manager no fix

euvd job_management_partner_1_software_distribution_client no fix

euvd job_management_partner_1_software_distribution_manager no fix

euvd jp1_it_desktop_management_2_manager fix: 12-60-12, 13-00-05, 13-01-07, 13-10-07, 13-11-04, 13-50-02

euvd jp1_it_desktop_management_2_operations_director fix: 12-60-12, 13-00-05, 13-01-07, 13-10-07, 13-11-04, 13-50-02

euvd jp1_it_desktop_management_manager no fix

euvd jp1_netm_dm_client no fix

euvd jp1_netm_dm_manager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 9 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is rooted in CWE-763 (Assertion with Side Effects), which typically manifests when buffer handling logic fails to properly validate input boundaries before writing to memory regions. In this context, the affected Hitachi products (JP1/IT Desktop Management 2 Manager/Operations Director, JP1/IT Desktop Management Manager, JP1/NETM/DM Manager/Client, and Job Management Partner 1 Software Distribution Manager/Client) running on Windows are susceptible to memory corruption when processing untrusted input. The CVSS vector AV:L/AC:L/PR:L indicates local attack vector with low complexity, requiring low-privilege authenticated access, suggesting the flaw exists in inter-process communication, file parsing, or local API handling within these management and distribution platforms.

Know when Jp1 It Desktop Management 2 Manager gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

13-00-05,12-60-12,13-11-04

CVE Published

Apr 07, 2026 - 05:43 nvd

MEDIUM 5.5

DescriptionCVE.org

Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.