CVE-2022-36407 is a critical log file vulnerability affecting numerous Hitachi Virtual Storage Platform models, including the G, F, E, and VP series, as well as Hitachi Unified Storage VM. This flaw allows local users to gain sensitive information due to the insertion of such data into log files. With a CVSS score of 9.9 (CRITICAL), the vulnerability has a network attack vector, low attack complexity, and high potential impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the CVE has garnered significant community discussion, indicating awareness among security professionals.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Hitachi | Hitachi Unified Storage VM | >= 0, < DKCMAIN Ver. 73(75)-03-75-X0/00, SVP Ver. 73(75)-03-74/00, >= 0, < DKCMAIN Ver. 73-03-75-X0/00, SVP Ver. 73-03-74/00CNA affecteddefault unaffected | |
| Hitachi | Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H | >= 0, < DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00, >= 0, < DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, >= 0, < DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00CNA affecteddefault unaffected | |
| Hitachi | Hitachi Virtual Storage Platform 5200, 5600, 5200H, 5600H | >= 0, < DKCMAIN Ver. 90-08-43-00/00, SVP Ver. 90-08-43/00, >= 0, < DKCMAIN Ver. 90-08-62-00/00, SVP Ver. 90-08-62/00, >= 0, < DKCMAIN Ver. 90-08-81-00/00, SVP Ver. 90-08-81/00CNA affecteddefault unaffected | |
| Hitachi | Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H | >= 0, < DKCMAIN Ver. 93-06-43-X0/00, SVP Ver. 93-06-43-X0/00, >= 0, < DKCMAIN Ver. 93-06-62-X0/00, SVP Ver. 93-06-62-X0/00, >= 0, < DKCMAIN Ver. 93-06-81-X0/00, SVP Ver. 93-06-81-X0/00CNA affecteddefault unaffected | |
| Hitachi | Hitachi Virtual Storage Platform F1500 | >= 0, < DKCMAIN Ver. 80-06-92-00/00, SVP Ver. 80-06-87/00CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.