CVE-2025-2902

HighCVSS 8.3/10Last modified Jun 29, 2026

Description

Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform.

This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 29, 2026
Last modified: Jun 29, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-290299.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function.CVE-2025-29038.5An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can log CVE-2025-290309.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function.CVE-2025-290319.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function.CVE-2025-290325.9Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function.CVE-2025-290337.3An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET par CVE-2025-290365.9An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.CVE-2025-290397.2An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8 CVE-2025-290409.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737c CVE-2025-290419.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710c CVE-2025-290429.8An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232c CVE-2025-290439.8An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234