(Technical Alert) Vulnerabilities in Hitachi Remote Ops (Resolved in HRO Agent v2.1 and later)

Affected Products

• Hitachi Remote Ops Agent - (Version v2.0, or earlier)

The following vulnerabilities have been identified in v2.0 or earlier versions of the Hitachi Remote Ops (HRO) Agent:

• CVE-2026-108335 (Password Reset Functionality Missing Brute-Force Protection)
• CVE-2026-108336 (Token Signing Key Allows Unauthenticated Administrative Access)
• CVE-2026-108337 (Password Reset Code Accessible in User Listing API)

These vulnerabilities have all been resolved in the latest available version of the HRO Agent. Please see the "Recommended Actions" section, below.

CVE-2026-108335 (Password Reset Functionality Missing Brute-Force Protection)

Overview
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.
Description
There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.
Impact
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Temporary Solution
Disable the password reset feature in the web interface.

CVE-2026-108336 (Token Signing Key Allows Unauthenticated Administrative Access)

Overview
When the default self-signed certificate is used, an attacker could gain administrative access to the application.
Description
The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login.
Impact
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Temporary Solution
Replace the default self-signed certificate for the web interface with a different one.

CVE-2026-108337 (Password Reset Code Accessible in User Listing API)

Overview
An administrator could retrieve the password reset code for any user and take over the account.
Description
The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
Impact
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Temporary Solution
Disable the password reset feature in the web interface.

Please implement the temporary solutions described above or, preferably, upgrade to Remote Ops Agent v2.1 (currently available for download on Hitachi Vantara Support Connect), which contains permanent fixes for these vulnerabilities:

Support Connect (login required)

The information contained herein is for informational purposes only. It is not intended as a guaranty or warranty about Hitachi Vantara’s products, including any guaranty or warranty that any product cannot be exploited by third parties. All product warranties and obligations to a customer must be specified in a mutually acceptable and executed contract between the parties.