Hitachi VSP One Block EUVD-2025-210367

Exploitation requires the attacker to hold at least low-privilege authenticated credentials on the Hitachi VSP One Block management interface (PR:L per CVSS). Additionally, an authorized user must be induced to or independently trigger a firmware update operation (UI:R), meaning the attack cannot be executed in a fully autonomous manner. The attack complexity is rated High (AC:H), indicating that simply being authenticated is insufficient - the attacker must also successfully forge or manipulate the firmware package's signing token (likely JWT) in a way that passes partial validation. Exploitation is constrained to VSP One Block models 23, 24, 26, and 28 running firmware versions prior to DKCMAIN A3-04-21-40/00 and ESM A3-04-21/00. Exploitation is limited by: requirement for existing authenticated management-plane access, requirement for user-initiated firmware update action, high attack complexity in forging the cryptographic validation material, and the niche enterprise deployment context of the hardware.

The vendor-assigned CVSS 3.1 score of 3.7 (Low) reflects a constrained attack profile: network-accessible (AV:N) but requiring high attack complexity (AC:H), authenticated access (PR:L), and user interaction (UI:R), with limited integrity and availability impact (I:L, A:L) and no confidentiality impact (C:N). The 'Information Disclosure' tag is inconsistent with C:N in the CVSS vector - this discrepancy should be verified with the vendor advisory, as the actual confidentiality impact may be understated. EPSS data is not provided in the available intelligence, and the vulnerability is not listed in CISA KEV. No public proof-of-concept exploit has been identified. Real-world risk is further bounded by the niche deployment footprint of Hitachi VSP One Block hardware; exploitation requires an attacker who is already authenticated to the storage management plane and can trigger a firmware update workflow. This is not a mass-exploitation candidate, but in environments where storage availability is critical, even a Low CVSS score for firmware tampering warrants prompt patching given the potential downstream impact of a compromised storage controller.

An attacker with valid low-privilege credentials on the storage management interface crafts a firmware package with a forged or manipulated JWT-based signature, then induces an authorized administrator to initiate a firmware update (satisfying the UI:R requirement). The storage platform accepts the package without adequate cryptographic verification, applies the tampered firmware to the DKCMAIN or ESM component, and the attacker achieves unauthorized modification of the storage controller firmware. No public proof-of-concept exists at time of analysis.