# CVE-2025-1978: Hitachi Virtual Storage Platform RCE in Storage Navigator

Source: https://junglewise.ai/threats/cve-2025-1978-hitachi-virtual-storage-platform-rce-in-storage-navigator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-1978 · Severity: high · CVSS 8.3 · Published 2026-05-07

A critical security vulnerability has been identified in the management software for Hitachi Virtual Storage Platforms, which are high-performance systems used for enterprise data storage. This flaw allows an unauthorized person to remotely execute commands on the storage management console. If exploited, an attacker could potentially disrupt storage operations, gain unauthorized access to management functions, or compromise the integrity of the storage environment.

Technologies: [Hitachi Virtual Storage Platform E390/E590/E790/E990/E1090/E390H/E590H/E790H/E1090H](https://junglewise.ai/threats/technologies/virtual-storage-platform-e-series). Vendors: [Hitachi](https://junglewise.ai/threats/vendors/hitachi).

## Quick answers

**Is CVE-2025-1978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-1978 being exploited in the wild.

**How severe is CVE-2025-1978?** High severity, with a CVSS score of 8.3, published 7 May 2026.

**Which products and versions are affected?** Hitachi Virtual Storage Platform E390/E590/E790/E990/E1090/E390H/E590H/E790H/E1090H DKCMAIN before 93-07-26-xx/00, SVP before 93-07-26-xx/00; Hitachi Virtual Storage Platform F350/F370/F700/F900 DKCMAIN before 88-08-16-xx/00, SVP before 88-08-18-xx/00; Hitachi Virtual Storage Platform G130/G150/G350/G370/G700/G900 DKCMAIN before 88-08-16-xx/00, SVP before 88-08-18-xx/00; Hitachi Virtual Storage Platform One Block 23/24/26/28 DKCMAIN before A3-04-02-xx/00, MPC before A3-04-02-xx/00.

**Is there a fix for CVE-2025-1978?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-1978 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-1978?** Check whether you run Hitachi Virtual Storage Platform E390/E590/E790/E990/E1090/E390H/E590H/E790H/E1090H, Hitachi Virtual Storage Platform F350/F370/F700/F900, Hitachi Virtual Storage Platform G130/G150/G350/G370/G700/G900 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution (RCE) vulnerability exists in Hitachi Storage Navigator and the associated maintenance consoles (SVP/MPC) across multiple Virtual Storage Platform (VSP) models. The vulnerability is classified as Improper Control of Generation of Code (CWE-94), suggesting a code injection flaw within the management interface. An unauthenticated attacker can exploit this over the network to execute arbitrary code on the management processor. This could lead to full compromise of the storage management layer. Hitachi has released microcode updates for affected DKCMAIN, SVP, and MPC components to remediate the issue.

## Affected products

- Hitachi Virtual Storage Platform G130/G150/G350/G370/G700/G900 DKCMAIN before 88-08-16-xx/00, SVP before 88-08-18-xx/00
- Hitachi Virtual Storage Platform F350/F370/F700/F900 DKCMAIN before 88-08-16-xx/00, SVP before 88-08-18-xx/00
- Hitachi Virtual Storage Platform E390/E590/E790/E990/E1090/E390H/E590H/E790H/E1090H DKCMAIN before 93-07-26-xx/00, SVP before 93-07-26-xx/00
- Hitachi Virtual Storage Platform One Block 23/24/26/28 DKCMAIN before A3-04-02-xx/00, MPC before A3-04-02-xx/00

## Timeline

- 2026-03-27: disclosed: Initial vendor advisory published by Hitachi
- 2026-05-07: advisory: CVE published to NVD

## References

- [https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_307.html](https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_307.html)

## Related threats

- [Hitachi Virtual Storage Platform improper authorization in Maintenance Utility](https://junglewise.ai/threats/cve-2025-2902-hitachi-virtual-storage-platform-improper-authorization-in)