# CVE-2025-2902: Hitachi Virtual Storage Platform improper authorization in Maintenance Utility

Source: https://junglewise.ai/threats/cve-2025-2902-hitachi-virtual-storage-platform-improper-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2025-2902 · Severity: high · CVSS 8.3 · Published 2026-06-29

A security vulnerability has been identified in the maintenance utility of Hitachi Virtual Storage Platforms, which are high-performance systems used for enterprise data storage and management. An attacker with low-level access to the management interface could perform unauthorized actions, potentially leading to data modification or service disruptions. This could impact the integrity of stored business data and the availability of critical storage services.

Technologies: [Hitachi Virtual Storage Platform E390/E590/E790/E990/E1090/E390H/E590H/E790H/E1090H](https://junglewise.ai/threats/technologies/virtual-storage-platform-e-series). Vendors: [Hitachi](https://junglewise.ai/threats/vendors/hitachi).

## Quick answers

**Is CVE-2025-2902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-2902 being exploited in the wild.

**How severe is CVE-2025-2902?** High severity, with a CVSS score of 8.3, published 29 June 2026.

**Which products and versions are affected?** Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform E390/E590/E790/E990/E1090/E390H/E590H/E790H/E1090H before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00.

**Is there a fix for CVE-2025-2902?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-2902 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-2902?** Check whether you run Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H, Hitachi Virtual Storage Platform E390/E590/E790/E990/E1090/E390H/E590H/E790H/E1090H, Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700 or F900 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability (CWE-862) exists in the management GUI (Maintenance Utility) of several Hitachi Virtual Storage Platform (VSP) models. The flaw allows a remote attacker with low-privileged credentials (PR:L) to bypass intended authorization checks. Successful exploitation can lead to unauthorized modification of system settings or data (I:H) and potential disruption of storage services (A:H). The vulnerability is addressed by updating the system microcode (DKCMAIN and GUM) to the versions specified in the manufacturer's advisory.

## Affected products

- Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00
- Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00
- Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900 before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00

## Timeline

- 2026-03-27: advisory: Initial advisory published by Hitachi
- 2026-06-29: disclosed: CVE published to NVD dataset

## References

- [https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_305.html](https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_305.html)

## Related threats

- [Hitachi Virtual Storage Platform RCE in Storage Navigator](https://junglewise.ai/threats/cve-2025-1978-hitachi-virtual-storage-platform-rce-in-storage-navigator)