CVE-2021-29645

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-12 · updated 2026-06-17

Description

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.

Affected products

Hitachi It Operations Director: from 02-50 through 02-50-07; from 03-00 through 03-00-12; from 04-00 through 04-00-17; from 04-50 through 04-50-16
Hitachi Job Management Partner 1/It Desktop Management-Manager: from 09-50 through 09-50-03; from 10-01 through 10-01-06; from 10-10 through 10-10-16
Hitachi Job Management Partner 1/It Desktop Management 2-Manager: from 10-50 through 10-50-11
Hitachi Job Management Partner 1/Remote Control Agent: from 08-00 through 08-00-04; from 08-10 through 08-10-05; from 08-51 through 08-51-18; from 09-00 through 09-00-07; from 09-50 through 09-50-09; from 09-51 through 09-51-15
Hitachi Job Management Partner 1/Software Distribution Client: from 08-00 through 08-00-05; from 08-10 through 08-10-06; from 08-51 through 08-51-19; from 09-00 through 09-00-09; from 09-50 through 09-50-09; from 09-51 through 09-51-13
Hitachi Job Management Partner 1/Software Distribution Manager: from 08-00 through 08-00-07; from 08-10 through 08-10-06; from 08-51 through 08-51-19; from 09-00 through 09-00-09; from 09-50 through 09-50-09; from 09-51 through 09-51-13
Hitachi Jp1/It Desktop Management-Manager: from 09-50 through 09-50-03; from 09-51 through 09-51-05; from 10-00 through 10-00-02; from 10-01 through 10-01-05; from 10-02 through 10-02-05; from 10-10 through 10-10-16
Hitachi Jp1/It Desktop Management 2-Manager: from 10-50 through 10-50-12; from 11-00 through 11-00-11; from 11-01 through 11-01-12; from 11-10 through 11-10-10; from 11-50 through 11-50-08; from 11-51 through 11-51-10
Hitachi Jp1/It Desktop Management 2-Operations Director: from 11-01 through 11-01-12; from 11-10 through 11-10-10; from 11-50 through 11-50-08; from 11-51 through 11-51-10; from 12-00 through 12-00-09; from 12-10 through 12-10-07
Hitachi Jp1/Netm/Dm Client: from 08-00 through 08-00-09; from 08-01 through 08-01-04; from 08-02 through 08-02-07; from 08-10 through 08-10-13; from 08-11 through 08-11-17; from 08-12 through 08-12-03
Hitachi Jp1/Netm/Dm Client-Remote Control Feature: from 08-00 through 08-00-06; from 08-01 through 08-01-03; from 08-02 through 08-02-04; from 08-10 through 08-10-10; from 08-11 through 08-11-06; from 08-50 through 08-50-04
Hitachi Jp1/Netm/Dm Manager: from 08-00 through 08-00-09; from 08-02 through 08-02-07; from 08-10 through 08-10-13; from 08-11 through 08-11-17; from 08-50 through 08-50-08; from 08-51 through 08-51-18
Hitachi Jp1/Netm/Remote Control Feature: from 08-00 through 08-00-06; from 08-01 through 08-01-03; from 08-02 through 08-02-04; from 08-10 through 08-10-10; from 08-11 through 08-11-06; from 08-50 through 08-50-04
Hitachi Jp1/Remote Control Feature: from 11-00 through 11-00-02; from 12-00 through 12-00-011

References

Get alerted when CVE-2021-29645 or the next vulnerability affects your stack