Information exposure vulnerability in Hitachi Storage Navigator

CVE-2025-7386 is a CWE-522 Insufficiently Protected Credentials flaw in Hitachi Storage Navigator, the browser/SVP management plane for Hitachi VSP/HUS-family enterprise disk arrays. An attacker who already holds a high-privilege Storage Navigator account can retrieve stored secrets — typically the credentials used by the array to talk to integrated services (LDAP/AD bind, SNMP traps, syslog, email relay, replication peers, or external KMS). The Scope:Changed flag in the CVSS vector is the tell: leaked material grants access to systems *beyond* the storage controller itself. Affected versions track the Storage Navigator builds shipped with current SVP firmware; the fixed builds are listed in Hitachi's June 2026 advisory.

Hitachi's MEDIUM / 6.8 rating is essentially fair, maybe slightly generous. The PR:H precondition is doing nearly all the work — by the time an attacker is a Storage Navigator admin, they can already wipe LUNs, snapshot any volume, and stage exfil through replication. The *additional* damage from cred recovery is real (LDAP bind account → AD reconnaissance, KMS account → reach into other systems) but it is a lateral amplifier, not a new front door. No KEV, no PoC, no exploitation chatter.

Why this verdict

• Privilege gate is decisive: PR:H means the attacker is already a Storage Navigator admin. That role can already snapshot, replicate, or wipe every LUN on the array — extracting an LDAP bind account is incremental, not transformative.
• Population narrowing: Storage Navigator is OOB-management software. GreyNoise/Shodan/Censys exposure is essentially zero. The reachable attack surface is internal management VLANs only, so the *unauthenticated* internet population this affects is ~0.
• Role multiplier — storage controller: Hitachi VSP arrays sit in the high-value-role catalog as production data tier. The chain succeeds, but it requires admin compromise as a precondition; the role multiplier therefore upgrades the *consequence* (cred leak → directory reconnaissance) but does not break the floor downward because the attacker has already achieved the high-value role.
• Role multiplier — workstation/dev: Not applicable. Storage Navigator is not deployed on workstations.
• No exploitation signal: Zero KEV, zero PoC, same-day disclosure, no GreyNoise tag. The defensive clock is set by vendor patch cadence, not adversary pressure.
• Confidentiality-only impact: Vector ends C:H/I:N/A:N. No write, no DoS — pure information disclosure of stored secrets.

Why not higher?

HIGH would require either a meaningful unauthenticated population (there isn't one — this is OOB management software), an active exploitation signal (none), or a role multiplier where the *vulnerability itself* gives access to a high-value role (it does not — the attacker must already be there). Without one of those three, anchoring at MEDIUM is correct.

Why not lower?

LOW would understate the Scope:Changed reality — leaked LDAP/KMS credentials genuinely pivot into the directory or key-management plane, which is a real lateral capability in an audit context. Storage arrays also hold regulated and backup data, so any confidentiality bug on the management plane deserves a tracked remediation window rather than backlog hygiene.

1. Enforce SVP/Storage Navigator access through a PAM jumphost only — Block direct admin-workstation-to-SVP HTTPS at the management firewall; require checkout through CyberArk/Delinea/BeyondTrust with session recording. Deploy this configuration immediately if not already in place — there is no noisgate mitigation SLA for MEDIUM, but this is a freebie control regardless of CVE-2025-7386.
2. Rotate all Storage Navigator-stored integration credentials — Treat the bug as already-exploited within the audit horizon. Rotate LDAP bind, SMTP, SNMPv3, replication, and KMS credentials that are configured inside Storage Navigator. Do this in parallel with patching; do not wait for the 365-day window to close.
3. Enable MFA on Storage Navigator administrator logins — If SVP supports upstream SAML/RADIUS MFA, turn it on. Raises the cost of step 2 (admin auth) and converts a stolen-password incident into a session-hijack-only incident.
4. Turn on SVP audit logging at full verbosity and forward to SIEM — Storage management is an under-monitored plane in most SOCs. Forward Storage Navigator audit logs to Splunk/Sentinel/Elastic and write a detection for admin-role API calls outside change windows.
5. Scope LDAP bind and KMS service accounts to least privilege — Assume any integration credential stored in array firmware will eventually leak. The bind account should be read-only and limited to the OUs the array actually queries; KMS accounts should be scoped to specific key handles.

Run this from a storage admin workstation or jumphost that can reach the SVP management IP over HTTPS. Invoke as .\Check-CVE-2025-7386.ps1 -SvpHost svp01.mgmt.example.com -Credential (Get-Credential). Requires a read-only Storage Navigator account to query the version banner; no write privileges needed. Update $fixedBuild once you have confirmed the exact remediated build from the Hitachi 2026-06 advisory.

#!/usr/bin/env pwsh
# Check-CVE-2025-7386.ps1
# Determines whether a Hitachi Storage Navigator / SVP is on a build affected by CVE-2025-7386.
# Exit 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

[CmdletBinding()]
param(
    [Parameter(Mandatory)] [string] $SvpHost,
    [Parameter(Mandatory)] [pscredential] $Credential,
    [int] $Port = 443,
    # TODO: replace with the exact remediated build string from the Hitachi June 2026 advisory.
    [string] $FixedBuild = '90-09-99/00'
)

$ErrorActionPreference = 'Stop'
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

function Write-Status($state, $msg) {
    Write-Host ("[{0}] {1}" -f $state, $msg)
}

try {
    $base  = "https://${SvpHost}:${Port}"
    $about = Invoke-WebRequest -Uri "$base/sanproject/about" `
                               -Credential $Credential `
                               -UseBasicParsing `
                               -SkipCertificateCheck `
                               -TimeoutSec 15
    $body = $about.Content

    if ($body -match 'SVP\s+(?:Version|Build)[^0-9]*([0-9]{2}-[0-9]{2}-[0-9]{2}/[0-9]{2})') {
        $build = $Matches[1]
        Write-Status 'INFO' "Detected SVP build: $build"
        if ([version]($build -replace '[^0-9.]', '.') -ge [version]($FixedBuild -replace '[^0-9.]', '.')) {
            Write-Status 'PATCHED' "Build $build is at or above fixed build $FixedBuild"
            exit 0
        } else {
            Write-Status 'VULNERABLE' "Build $build is below fixed build $FixedBuild — CVE-2025-7386 applies"
            exit 1
        }
    } else {
        Write-Status 'UNKNOWN' 'Could not parse SVP build from /sanproject/about response'
        exit 2
    }
}
catch {
    Write-Status 'UNKNOWN' ("Probe failed: {0}" -f $_.Exception.Message)
    exit 2
}

Sources

1. Hitachi Storage Solutions security information index
2. Hitachi Disk Array Systems advisories — 2025 archive
3. NVD CVE-2025-7386 detail
4. MITRE CVE-2025-7386
5. CWE-522: Insufficiently Protected Credentials
6. FIRST CVSS 3.1 calculator (vector reference)
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS scoring