Jp1 Integrated Management 3 Manager
Monthly
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.