CVE-2023-49106 is a medium severity (CVSS 4.6) flaw in the Hitachi Device Manager Agent on Windows and Linux, where a password field is not masked. It affects versions below 8.8.5-04. Hitachi fixed it in 8.8.5-04 on 16 January 2024, and says the agent must be upgraded too.
What's affected
- Hitachi Device Manager, Device Manager Agent component on Windows and Linux, versions below 8.8.5-04, per the NVD record and Hitachi advisory hitachi-sec-2024-101.
- Fixed: version 8.8.5-04, released 16 January 2024, for both the Device Manager Server and Device Manager Agent. Hitachi notes the agent must also be upgraded.
- For details on the fixed products, Hitachi says to contact your Hitachi support service representative.
- Hitachi's own vector is AV:P, which means physical access, and it matches the record's score of 4.6. There is no severity conflict.
- Severity: the record gives CVSS 4.6, which is medium. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Read plainly, it describes an attack with physical access, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity none and on availability none. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Find the Hitachi Device Manager Server and each Device Manager Agent in your environment, and read their version numbers. Anything below 8.8.5-04 is affected.
The agent runs on hosts that manage storage, so your storage team may own them. Ask them for a list of agent hosts, and check that each agent version matches the server version. Hitachi's note that the agent must also be upgraded is easy to miss when the server is patched first.
Also note who has physical or console access to those hosts, since the vector assumes physical access.
What to do now
- Upgrade Device Manager Server and every Device Manager Agent to 8.8.5-04 or later.
- Contact your Hitachi support representative for the fixed package details, as Hitachi advises.
- Limit physical and console access to hosts where the agent runs.
- Avoid entering passwords where others can see the screen on those hosts until the update is applied.
- Follow Hitachi's general advice to remove storage devices that are out of support from management and monitoring.
Why it matters
The classes are CWE-549 (Missing Password Field Masking) and CWE-522 (Insufficiently Protected Credentials). When a password field shows what is typed, anyone who can see the screen can read the password. That is a small flaw on its own, and the medium score reflects that physical access is needed.
It still matters because storage management tools tend to hold administrative access to arrays that hold company data. A password read over a shoulder can be reused. Low scoring flaws are worth fixing when the fix is already part of an update you need for other reasons.
Quick check
Why is the score only medium?
The vector requires physical access, and the only impact is on confidentiality.
Do I need to upgrade the agent as well as the server?
Yes. Hitachi's advisory notes that the Device Manager agent must also be upgraded.
Sources
Last reviewed: 19 October 2026.
