Jp1 Automatic Job Management System 3 Agent
Monthly
A heap-based buffer overflow (CWE-122) in Hitachi JP1/Automatic Job Management System 3 - Manager and 3 - Agent, covering versions from 11-00 up to but not including 13-50-31, is rated 9.8 with a network vector (AV:N/AC:L/PR:N/UI:N) - meaning successful exploitation could give remote, unauthenticated attackers full compromise of confidentiality, integrity and availability of the job-management service. Hitachi has released fixed builds at 13-50-31, but the available sources do not describe the specific feature, protocol or input that triggers the overflow, so no particular enabling configuration can be named. No public exploit code is confirmed, EPSS is low (0.52%, 44th percentile), and there is no KEV listing, yet the vuln.today decision label is act_now given the severity and the fact that this is an unauthenticated network-reachable memory-corruption flaw in infrastructure software.
Stack-based buffer overflow (CWE-121) in Hitachi JP1/Automatic Job Management System 3 - Manager, - Agent, and - Agent Minimal Edition lets remote attackers crash or potentially execute code in the context of the JP1/AJS3 service, with a vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N). Affected builds are Manager and Agent from 10-00/11-00 up to, but not including, 13-50-31, plus Agent Minimal Edition from 11-50 before 13-50-31; Hitachi has released 13-50-31 as the fix for all three branches. Severity signals and exploitation signals diverge: EPSS is only 0.52% (44th percentile) and no public exploit or KEV listing was identified at time of analysis, yet the vulnerability is remotely reachable with no authentication or user interaction, so vuln.today priority is act_now - the practical exposure limiter being that JP1/AJS3 components normally sit on segmented internal operations networks rather than the internet.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 allows remote, unauthenticated attackers to corrupt memory over the network with no user interaction, potentially compromising confidentiality and integrity and causing limited availability impact (CVSS 9.4). Hitachi reports affected Manager and Agent branches from 11-00 before 13-50-31, while EUVD also maps 10-00 branches and Agent Minimal Edition 11-50 to versions below 13-50-31. A vendor patch is available; no public exploit was identified at time of analysis (EPSS 0.45%), and CISA KEV does not list this CVE.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 can be reached over the network without authentication or user interaction under the vendor CVSS vector (CVSS 9.4, AV:N/AC:L/PR:N/UI:N), yielding high confidentiality and integrity impact and low availability impact. Hitachi has released fixed version 13-50-31, and the vuln.today priority is act_now. No CISA KEV entry or public exploit code was identified at time of analysis; EPSS is 0.45% (39th percentile), so the priority reflects severity and network exposure rather than observed exploitation.
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.
A heap-based buffer overflow (CWE-122) in Hitachi JP1/Automatic Job Management System 3 - Manager and 3 - Agent, covering versions from 11-00 up to but not including 13-50-31, is rated 9.8 with a network vector (AV:N/AC:L/PR:N/UI:N) - meaning successful exploitation could give remote, unauthenticated attackers full compromise of confidentiality, integrity and availability of the job-management service. Hitachi has released fixed builds at 13-50-31, but the available sources do not describe the specific feature, protocol or input that triggers the overflow, so no particular enabling configuration can be named. No public exploit code is confirmed, EPSS is low (0.52%, 44th percentile), and there is no KEV listing, yet the vuln.today decision label is act_now given the severity and the fact that this is an unauthenticated network-reachable memory-corruption flaw in infrastructure software.
Stack-based buffer overflow (CWE-121) in Hitachi JP1/Automatic Job Management System 3 - Manager, - Agent, and - Agent Minimal Edition lets remote attackers crash or potentially execute code in the context of the JP1/AJS3 service, with a vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N). Affected builds are Manager and Agent from 10-00/11-00 up to, but not including, 13-50-31, plus Agent Minimal Edition from 11-50 before 13-50-31; Hitachi has released 13-50-31 as the fix for all three branches. Severity signals and exploitation signals diverge: EPSS is only 0.52% (44th percentile) and no public exploit or KEV listing was identified at time of analysis, yet the vulnerability is remotely reachable with no authentication or user interaction, so vuln.today priority is act_now - the practical exposure limiter being that JP1/AJS3 components normally sit on segmented internal operations networks rather than the internet.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 allows remote, unauthenticated attackers to corrupt memory over the network with no user interaction, potentially compromising confidentiality and integrity and causing limited availability impact (CVSS 9.4). Hitachi reports affected Manager and Agent branches from 11-00 before 13-50-31, while EUVD also maps 10-00 branches and Agent Minimal Edition 11-50 to versions below 13-50-31. A vendor patch is available; no public exploit was identified at time of analysis (EPSS 0.45%), and CISA KEV does not list this CVE.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 can be reached over the network without authentication or user interaction under the vendor CVSS vector (CVSS 9.4, AV:N/AC:L/PR:N/UI:N), yielding high confidentiality and integrity impact and low availability impact. Hitachi has released fixed version 13-50-31, and the vuln.today priority is act_now. No CISA KEV entry or public exploit code was identified at time of analysis; EPSS is 0.45% (39th percentile), so the priority reflects severity and network exposure rather than observed exploitation.
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.