CVE-2023-49107 is a medium severity (CVSS 5.3) information exposure flaw in the Hitachi Device Manager Agent on Windows and Linux, where error messages contain sensitive information. It affects versions below 8.8.5-04. Hitachi fixed it in 8.8.5-04 on 16 January 2024.
What's affected
- Hitachi Device Manager, Device Manager Agent component on Windows and Linux, versions below 8.8.5-04, per the NVD record and Hitachi advisory hitachi-sec-2024-101.
- Fixed: version 8.8.5-04, released 16 January 2024, for both the Device Manager Server and Device Manager Agent. Hitachi notes the agent must also be upgraded.
- For details on the fixed products, Hitachi says to contact your Hitachi support service representative.
- Hitachi's published vector is a network based one with low confidentiality impact, matching the record's 5.3, so there is no severity conflict.
- Severity: the record gives CVSS 5.3, which is medium. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is low, on integrity none and on availability none. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Read the version of the Device Manager Server and every Device Manager Agent. Any version below 8.8.5-04 is in range.
Because this flaw leaks through error messages, also check where those messages go. Look at agent logs, and at which networks can reach the agent. If agent services are reachable from broad parts of the network, more people can trigger and read errors.
Storage teams often manage these hosts separately from general servers, so confirm that they appear in your asset list.
What to do now
- Upgrade the Device Manager Server and all agents to 8.8.5-04 or later.
- Contact Hitachi support for fixed package details, as the advisory says.
- Limit network access to the agent to the management systems that need it.
- Review agent logs for error output that contains sensitive values and handle those logs as sensitive.
- Remove storage devices that are out of support from management, following Hitachi's general advice.
Why it matters
The class is CWE-209 (Generation of Error Message Containing Sensitive Information). Error messages are written for developers and operators, and they sometimes include details such as paths, internal names or credentials. When those messages are shown to an unprivileged caller, they hand out information that helps further attacks.
The vector is network based and needs no privileges, but the impact is low and limited to confidentiality, so the score is medium. The record does not say which data is exposed, and we will not guess. The sensible response is to patch, limit who can reach the agent, and treat logs from management tools as sensitive.
Quick check
What data leaks?
The record only says error messages contain sensitive information. It does not say which values, so check the Hitachi advisory or your support contact.
Is a fix available?
Yes. Hitachi lists version 8.8.5-04, released 16 January 2024, for both server and agent.
Sources
Last reviewed: 19 October 2026.
