Hitachi Storage Platform Maintenance Utility Authorization Bypass

Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-2902 is an improper authorization vulnerability (CWE-862) affecting Hitachi Virtual Storage Platform maintenance utilities across multiple product lines and versions. This flaw allows unauthorized users to bypass access controls on critical storage infrastructure, potentially enabling attackers to perform administrative operations they should not have permission to execute. Organizations running affected Hitachi VSP models—including the E-series, 5000-series, and G/F-series platforms—face significant risk, as storage systems are foundational to business operations and data protection. The vulnerability maps to MITRE ATT&CK privilege escalation (TA0004) and credential access (TA0006) tactics, indicating attackers could exploit weak authorization checks to elevate privileges or extract sensitive authentication material.

Casky.ai's 283 mapped security skills enable practitioners to detect exploitation attempts by correlating behavioral patterns across both privilege escalation and credential access attack chains. Using Claude's extended reasoning capabilities, the platform analyzes maintenance utility access logs for anomalies such as unauthorized administrative commands, lateral movement patterns between storage controllers, and unusual credential usage tied to maintenance accounts. Practitioners monitoring their Hitachi VSP environments through Casky will receive findings flagged against specific MITRE techniques—such as TA0004 abuse of elevation mechanisms and TA0006 credential dumping from storage authentication systems—allowing security teams to distinguish legitimate maintenance activities from potential intrusions before systems are compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-2902.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2025-2902

Casky has 283 skills that investigate the attack patterns behind CVE-2025-2902. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn