Jp1 Base
Monthly
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.
Heap-based buffer overflow in Hitachi JP1/Base versions 11-00 through before 12-50-54 can be triggered by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and, per the vendor's severity rating of 9.8, may lead to full loss of confidentiality, integrity and availability of the affected service. Hitachi has released a fix in 12-50-54 and later, so exposure is limited to installations that have not yet been updated and that are reachable over the network. No public exploit code has been identified at time of analysis, and the EPSS score is modest at 0.52% (44th percentile), although the vendor's own advisory and the vuln.today decision signal both point to remediation as an immediate priority.
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.
Heap-based buffer overflow in Hitachi JP1/Base versions 11-00 through before 12-50-54 can be triggered by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and, per the vendor's severity rating of 9.8, may lead to full loss of confidentiality, integrity and availability of the affected service. Hitachi has released a fix in 12-50-54 and later, so exposure is limited to installations that have not yet been updated and that are reachable over the network. No public exploit code has been identified at time of analysis, and the EPSS score is modest at 0.52% (44th percentile), although the vendor's own advisory and the vuln.today decision signal both point to remediation as an immediate priority.