Login Sign Up

CVE-2022-36407

9.9 CRITICAL

📋 TL;DR

This vulnerability allows local users to gain sensitive information through insertion of sensitive data into log files in multiple Hitachi Virtual Storage Platform models. It affects numerous storage systems across various product lines when running vulnerable software versions. The issue enables unauthorized access to confidential information stored in logs.

💻 Affected Systems

Products:
  • Hitachi Virtual Storage Platform
  • Hitachi Virtual Storage Platform VP9500
  • Hitachi Virtual Storage Platform G1000
  • Hitachi Virtual Storage Platform G1500
  • Hitachi Virtual Storage Platform F1500
  • Hitachi Virtual Storage Platform 5100
  • Hitachi Virtual Storage Platform 5500
  • Hitachi Virtual Storage Platform 5100H
  • Hitachi Virtual Storage Platform 5500H
  • Hitachi Virtual Storage Platform 5200
  • Hitachi Virtual Storage Platform 5600
  • Hitachi Virtual Storage Platform 5200H
  • Hitachi Virtual Storage Platform 5600H
  • Hitachi Unified Storage VM
  • Hitachi Virtual Storage Platform G100
  • Hitachi Virtual Storage Platform G200
  • Hitachi Virtual Storage Platform G400
  • Hitachi Virtual Storage Platform G600
  • Hitachi Virtual Storage Platform G800
  • Hitachi Virtual Storage Platform F400
  • Hitachi Virtual Storage Platform F600
  • Hitachi Virtual Storage Platform F800
  • Hitachi Virtual Storage Platform G130
  • Hitachi Virtual Storage Platform G150
  • Hitachi Virtual Storage Platform G350
  • Hitachi Virtual Storage Platform G370
  • Hitachi Virtual Storage Platform G700
  • Hitachi Virtual Storage Platform G900
  • Hitachi Virtual Storage Platform F350
  • Hitachi Virtual Storage Platform F370
  • Hitachi Virtual Storage Platform F700
  • Hitachi Virtual Storage Platform F900
  • Hitachi Virtual Storage Platform E390
  • Hitachi Virtual Storage Platform E590
  • Hitachi Virtual Storage Platform E790
  • Hitachi Virtual Storage Platform E990
  • Hitachi Virtual Storage Platform E1090
  • Hitachi Virtual Storage Platform E390H
  • Hitachi Virtual Storage Platform E590H
  • Hitachi Virtual Storage Platform E790H
  • Hitachi Virtual Storage Platform E1090H
Versions: Multiple versions before specific DKCMAIN and SVP versions listed in CVE description
Operating Systems: Storage appliance OS
Default Config Vulnerable: ⚠️ Yes
Notes: Affects multiple product lines with different version requirements. Check specific model against version matrix in advisory.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attackers could extract sensitive credentials, configuration data, or proprietary information from log files, potentially leading to full system compromise or data exfiltration.

🟠

Likely Case

Local users with access to log files could read sensitive information that should be protected, violating confidentiality requirements.

🟢

If Mitigated

With proper access controls and log sanitization, the impact is limited to authorized personnel only accessing appropriate log data.

🌐 Internet-Facing: LOW - This requires local access to the storage system, not typically internet-facing.
🏢 Internal Only: HIGH - Internal users with local access to vulnerable storage systems could exploit this to gain sensitive information.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Requires local access to the storage system. Exploitation involves reading log files containing sensitive information.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Update to DKCMAIN and SVP versions specified in the CVE description for each product line

Vendor Advisory: https://www.hitachi.com/products/it/storage-solutions/sec_info/2024/2022_313.html

Restart Required: Yes

Instructions:

1. Identify your specific Hitachi storage model
2. Check current DKCMAIN and SVP versions
3. Download appropriate firmware update from Hitachi support portal
4. Follow Hitachi's firmware update procedures for your model
5. Verify update completion and version numbers

🔧 Temporary Workarounds

Restrict log file access

all

Implement strict file permissions on log directories to prevent unauthorized access

chmod 640 /var/log/*
chown root:admin /var/log/*

Implement log sanitization

all

Configure logging systems to exclude sensitive information from logs

🧯 If You Can't Patch

  • Implement strict access controls to limit who can access storage system locally
  • Monitor log file access and implement alerting for unauthorized access attempts

🔍 How to Verify

Check if Vulnerable:

Check current DKCMAIN and SVP versions against vulnerable versions listed in CVE description for your specific model

Check Version:

Check via Hitachi storage management interface or CLI commands specific to your model

Verify Fix Applied:

Verify DKCMAIN and SVP versions are at or above the patched versions specified in the advisory

📡 Detection & Monitoring

Log Indicators:

  • Unauthorized access to log files
  • Multiple failed attempts to access sensitive log directories

Network Indicators:

  • Unusual local network traffic to storage management interfaces

SIEM Query:

source="storage_system" AND (event="file_access" AND file_path="*log*" AND user!="authorized_user")

📊 Metadata

CVE ID: CVE-2022-36407
CVSS v3 Score: 9.9 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-532
Published: March 25, 2024
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-36407, you might also want to check these:

CVE-2021-32724 9.9

CVE-2021-32724 is a critical vulnerability in the check-spelling GitHub Action that allows attackers...

Same vulnerability type (CWE-532)
CVE-2025-6391 9.8

Brocade ASCG versions before 3.3.0 log JSON Web Tokens (JWT) in plain text within log files. Attacke...

Same vulnerability type (CWE-532)
CVE-2024-52009 9.8

CVE-2024-52009 is a critical vulnerability in Atlantis that logs GitHub access tokens during rotatio...

Same vulnerability type (CWE-532)