CVE-2020-36695: File and Directory Permission Vulnerability in Hitachi Command Suite

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-18 · updated 2026-06-17
Weakness: CWE-276

Description

Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi Tuning Manager - Agent for NAS components), Hitachi Compute Systems Manager on Linux allows File Manipulation.This issue affects Hitachi Device Manager: before 8.8.5-02; Hitachi Tiered Storage Manager: before 8.8.5-02; Hitachi Replication Manager: before 8.8.5-02; Hitachi Tuning Manager: before 8.8.5-02; Hitachi Compute Systems Manager: before 8.8.3-08.

Affected products

Hitachi Compute Systems Manager: before 8.8.3-08 — fixed in 8.8.3-08
Hitachi Device Manager: before 8.8.5-02 — fixed in 8.8.5-02
Hitachi Replication Manager: before 8.8.5-02 — fixed in 8.8.5-02
Hitachi Tiered Storage Manager: before 8.8.5-02 — fixed in 8.8.5-02
Hitachi Tuning Manager: before 8.8.5-02 — fixed in 8.8.5-02

How to fix

Upgrade to a fixed version: Hitachi Compute Systems Manager 8.8.3-08; Hitachi Device Manager 8.8.5-02; Hitachi Replication Manager 8.8.5-02; Hitachi Tiered Storage Manager 8.8.5-02; Hitachi Tuning Manager 8.8.5-02. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36695 or the next vulnerability affects your stack