{"id":"CVE-2026-112125","kind":"vulnerability","aliases":["CVE-2026-112125"],"related":[],"title":"HA Monitor: incorrect permissions on a critical resource; upgrade to the fixed release for your branch","description":"Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor.\n\nThis issue affects HA Monitor: from 01-00 before 01-83-01.","summary":"Hitachi says HA Monitor has an Incorrect Permission Assignment for Critical Resource flaw (CVSS 7.3, local, low privileges, user interaction required). Hitachi does not name the resource or describe the impact beyond the CVSS vector. Fixed releases exist for each affected branch on AIX, Linux and HP-IPF.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HA Monitor","fixed":["01-35-02","01-42-02","01-58-02","01-70-01","01-77-02","01-83-01","01-34-01"],"affected":"JP: AIX 01-00 to 01-35-01; Linux 01-10 to 01-42-01, 01-42 to 01-58-01, 01-60 to 01-70, 01-71 to 01-77-01, 01-78 to 01-83; HP-IPF 01-07 to 01-34. EN: Linux 01-52 to 01-58-01, 01-60 to 01-70, 01-71 to 01-77-01, 01-78 to 01-83","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aix","ha-monitor","hitachi","hp-ux","linux","other"],"not_affected_if":["patched-branch-release"],"how_to_check":"Find the installed HA Monitor version and compare it with the affected ranges in hitachi-sec-2026-163 for your OS and language edition. Affected: Japanese AIX 01-00 to 01-35-01; Linux 01-10 to 01-42-01, 01-42 to 01-58-01, 01-60 to 01-70, 01-71 to 01-77-01, 01-78 to 01-83; HP-IPF 01-07 to 01-34. English Linux 01-52 to 01-58-01, 01-60 to 01-70, 01-71 to 01-77-01, 01-78 to 01-83.","fix":"Upgrade to the fixed release for your branch. Japanese version: AIX 01-35-02; Linux 01-42-02, 01-58-02, 01-70-01, 01-77-02, 01-83-01; HP-IPF 01-34-01. English version (Linux): 01-58-02, 01-70-01, 01-77-02, 01-83-01.","status":"open","published_at":"2026-11-10T05:17:42+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:22+00:00","updated_at":"2026-11-10T05:23:48+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T05:22:22Z","model":"claude-haiku-5-5","output":{"fix":"- HA Monitor: `01-83-01` (fixed version per the description: fixes affect versions before `01-83-01`)","reach":"unknown","title":"HA Monitor: incorrect permissions on a critical resource expose it","impact":"medium","summary":"HA Monitor versions from 01-00 before 01-83-01 assign incorrect permissions to a critical resource. The sources do not say what the resource is or what an attacker can do with it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ha-monitor"],"confidence":0.3,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; permissions on a critical resource are wrong","analyst_note":"Identify the vendor and the affected critical resource, and confirm the 01-83-01 fixed version from the NVD entry or vendor advisory.","how_to_check":"- unknown","plain_action":"","product_name":"HA Monitor","needs_analyst":true,"not_affected_if":[],"who_is_affected":"HA Monitor installations on versions from 01-00 up to but not including 01-83-01. The sources do not say which component or deployment pattern is exposed, so unknown beyond the version range.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4507,"output_tokens":468,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and the affected critical resource, and confirm the 01-83-01 fixed version from the NVD entry or vendor advisory.","search":"'-00':100C '-01':104C '-112125':19A,22A '-2026':18A,21A '-83':103C '01':99C,102C '7.3':48B 'affect':74B,95C 'aix':25B,77B 'assign':42B,85C 'beyond':65B 'branch':16A,75B 'critic':7A,44B,87C 'cve':17A,20A 'cvss':47B,67B 'describ':62B 'exist':71B 'fix':12A,69B 'flaw':46B 'ha':1A,23A,27B,36B,91C,96C 'ha-monitor':26B 'hitachi':29B,34B,55B 'hp':31B,81B 'hp-ipf':80B 'hp-ux':30B 'impact':64B 'incorrect':3A,40B,83C 'interact':53B 'ipf':82B 'issu':94C 'linux':33B,78B 'local':49B 'low':50B 'monitor':2A,24A,28B,37B,92C,97C 'name':58B 'permiss':4A,41B,84C 'privileg':51B 'releas':13A,70B 'requir':54B 'resourc':8A,45B,60B,88C 'say':35B 'upgrad':9A 'user':52B 'ux':32B 'vector':68B 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":"Systems running Hitachi HA Monitor (Japanese edition on AIX, Linux, HP-IPF; English edition on Linux) in the version ranges Hitachi lists. The attack is local with low privileges and needs user interaction. Hitachi does not say which resource is affected. Installations already at or above the fixed release for their branch can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T05:23:48Z","by":"analyst","doc":"https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-163/index.html","run_id":2410},"products":{"at":"2026-11-10T05:23:48Z","by":"analyst","doc":"https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-163/index.html","run_id":2410},"who_affected":{"at":"2026-11-10T05:23:48Z","by":"analyst","doc":"https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-163/index.html","run_id":2410}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["hamonitor","monitor"],"ptokens":["ha","monitor"],"labels":["aix","hamonitor","high","hitachi","hpux","linux","other","vendor"],"campaign_type":null,"search_a":"'-112125':19A,22A '-2026':18A,21A 'branch':16A 'critic':7A 'cve':17A,20A 'fix':12A 'ha':1A,23A 'incorrect':3A 'monitor':2A,24A 'permiss':4A 'releas':13A 'resourc':8A 'upgrad':9A","search_b":"'7.3':48B 'affect':74B 'aix':25B,77B 'assign':42B 'beyond':65B 'branch':75B 'critic':44B 'cvss':47B,67B 'describ':62B 'exist':71B 'fix':69B 'flaw':46B 'ha':27B,36B 'ha-monitor':26B 'hitachi':29B,34B,55B 'hp':31B,81B 'hp-ipf':80B 'hp-ux':30B 'impact':64B 'incorrect':40B 'interact':53B 'ipf':82B 'linux':33B,78B 'local':49B 'low':50B 'monitor':28B,37B 'name':58B 'permiss':41B 'privileg':51B 'releas':70B 'requir':54B 'resourc':45B,60B 'say':35B 'user':52B 'ux':32B 'vector':68B","search_c":"'-00':100C '-01':104C '-83':103C '01':99C,102C 'affect':95C 'assign':85C 'critic':87C 'ha':91C,96C 'incorrect':83C 'issu':94C 'monitor':92C,97C 'permiss':84C 'resourc':88C 'vulner':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112125","severity":null,"published_at":"2026-11-10T05:17:42+00:00","modified_at":"2026-11-10T05:17:42+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112125:2410","url":"https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-163/index.html","severity":null,"published_at":"2026-11-10T05:23:48+00:00","modified_at":"2026-11-10T05:23:48+00:00","first_seen_at":"2026-11-10T05:23:48+00:00","fetched_at":"2026-11-10T05:23:48+00:00","note":"Read Hitachi hitachi-sec-2026-163: lists affected/fixed per OS and language branch; resource and attack details not disclosed; no workaround listed. 01-83-01 is only the fix for the 01-78..01-83 Linux branch.","cites":["https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-163/index.html"]}],"documents":[{"id":113274,"url":"https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-163/index.html","title":"Vulnerability in HA Monitor (hitachi-sec-2026-163)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}