Skip to content
Fencer Vulns
critical 9.9

CVE-2022-36407 json

Information Exposure Vulnerability in Hitachi Disk Array Systems

published 2024-03-25 2 y ago modified 2026-06-17 4 mo ago also EUVD-2022-39120

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual Storage Platform VP9500, Hitachi Virtual Storage Platform G1000, G1500, Hitachi Virtual Storage Platform F1500, Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, Hitachi Virtual Storage Platform 5200, 5600, 5200H, 5600H, Hitachi Unified Storage VM, Hitachi Virtual Storage Platform G100, G200, G400, G600, G800, Hitachi Virtual Storage Platform F400, F600, F800, Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, Hitachi Virtual Storage Platform F350, F370, F700, F900, Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H allows

local users to gain sensitive information.This issue affects Hitachi Virtual Storage Platform: before DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00; Hitachi Virtual Storage Platform VP9500: before DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00; Hitachi Virtual Storage Platform G1000, G1500: before DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00; Hitachi Virtual Storage Platform F1500: before DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00; Hitachi Virtual Storage Platform 5100, 5500,5100H, 5500H: before DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, before DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, before DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00; Hitachi Virtual Storage Platform 5200, 5600,5200H, 5600H: before DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00, before DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, before DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00; Hitachi Unified Storage VM: before DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00, before DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00; Hitachi Virtual Storage Platform G100, G200, G400, G600, G800: before DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, before DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00; Hitachi Virtual Storage Platform F400, F600, F800: before DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00, before DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900: before DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02; Hitachi Virtual Storage Platform F350, F370, F700, F900: before DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02; Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00, before DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00, before DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00.

Patch / fix

  • Hitachi Hitachi Virtual Storage Platform DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00
  • Hitachi Hitachi Virtual Storage Platform VP9500 DKCMAIN Ver. 70-06-74-00/00, SVP Ver. 70-06-58/00
  • Hitachi Hitachi Virtual Storage Platform G1000, G1500 DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00
  • Hitachi Hitachi Virtual Storage Platform F1500 DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00
  • Hitachi Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00, DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00
  • Hitachi Hitachi Virtual Storage Platform 5200, 5600, 5200H, 5600H DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00, DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00
  • Hitachi Hitachi Unified Storage VM DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00, DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00
  • Hitachi Hitachi Virtual Storage Platform G100, G200, G400, G600, G800 DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00, DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00
  • Hitachi Hitachi Virtual Storage Platform F400, F600, F800 DKCMAIN Ver. 83-05-47-X0/00, SVP Ver. 83-05-51-X0/00, DKCMAIN Ver. 83-06-19-X0/00, SVP Ver. 83-06-20-X0/00
  • Hitachi Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900 DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02
  • Hitachi Hitachi Virtual Storage Platform F350, F370, F700, F900 DKCMAIN Ver. 88-08-09-XX/00, SVP Ver. 88-08-11-X0/02
  • Hitachi Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00, DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00, DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Hitachi Hitachi Virtual Storage Platform
  • Hitachi Hitachi Virtual Storage Platform VP9500
  • Hitachi Hitachi Virtual Storage Platform G1000, G1500
  • Hitachi Hitachi Virtual Storage Platform F1500
  • Hitachi Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H
  • Hitachi Hitachi Virtual Storage Platform 5200, 5600, 5200H, 5600H
  • Hitachi Hitachi Unified Storage VM
  • Hitachi Hitachi Virtual Storage Platform G100, G200, G400, G600, G800
  • Hitachi Hitachi Virtual Storage Platform F400, F600, F800
  • Hitachi Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900
  • Hitachi Hitachi Virtual Storage Platform F350, F370, F700, F900
  • Hitachi Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.