« Volver al listado

CVE-2025-66445

Estado: AplazadaAlta (7.1)—

Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component) and Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N, PR:L sin UI: acceso remoto con privilegios previos (T1210). Bypass de autorización (CWE-306) permite acceso no autorizado a datos (T1078 como identity spoofing, T1005 por confidencialidad alta).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Hitachi — Infrastructure Analytics AdvisorAIHitachi — OPS Center AnalyzerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-66445",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-66445",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-24T14:15:23.222538Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "hirt@hitachi.co.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "hirt@hitachi.co.jp",
      "affectedData": [
        {
          "vendor": "Hitachi",
          "modules": [
            "Data Center Analytics"
          ],
          "product": "Hitachi Infrastructure Analytics Advisor",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "*"
            }
          ],
          "platforms": [
            "Linux",
            "64 bit"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Hitachi",
          "modules": [
            "Hitachi Ops Center Analyzer detail view"
          ],
          "product": "Hitachi Ops Center Analyzer",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "11.0.5-00",
                  "status": "unaffected"
                }
              ],
              "version": "10.0.0-00",
              "lessThan": "11.0.5-00",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Linux",
            "64 bit"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-24T05:16:08.607",
  "references": [
    {
      "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-133/index.html",
      "source": "hirt@hitachi.co.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "hirt@hitachi.co.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component) and Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00."
    }
  ],
  "lastModified": "2026-06-17T09:56:51.417",
  "sourceIdentifier": "hirt@hitachi.co.jp"
}