Skip to content
Fencer Vulns
high 8.8

CVE-2021-20740 json

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a ver…

published 2021-06-28 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8154

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08(NEC2.5.4a) and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08(NEC3.4.2) allow remote authenticated attackers to execute arbitrary OS commands with root privileges via unspecified vectors.

Patch / fix

  • hitachi virtual_file_platform 5.5.3-09, 6.4.3-09
  • nec nas_gateway_nh4a_firmware fos_5.5.3-08\(nec2.5.4a\)
  • nec nas_gateway_nh8a_firmware fos_5.5.3-08\(nec2.5.4a\)
  • nec nas_gateway_nh4b_firmware fos_6.4.3-08\(nec3.4.2\)
  • nec nas_gateway_nh8b_firmware fos_6.4.3-08\(nec3.4.2\)
  • nec nas_gateway_nh4c_firmware fos_6.4.3-08\(nec3.4.2\)
  • nec nas_gateway_nh8c_firmware fos_6.4.3-08\(nec3.4.2\)

Exploit prediction

3.11% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

  • Hitachi and NEC Corporation Hitachi Virtual File Platform and NEC Storage M Series NAS Gateway which uses Hitachi Virtual File Platform

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.