Hitachi JP1 IT Desktop Management 2 on Windows file inclusion

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Hitachi JP1 IT Desktop Management 2, Job Management Partner 1 IT Desktop Management, NETM DM Manager, DM Client, Software Distribution Manager and Software Distribution Client on Windows. The affected element is an unknown function. Performing a manipulation results in file inclusion. This vulnerability was named CVE-2025-65115. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Hitachi JP1 IT Desktop Management 2, Job Management Partner 1 IT Desktop Management, NETM DM Manager, DM Client, Software Distribution Manager and Software Distribution Client on Windows. It has been classified as very critical. This affects an unknown functionality. The manipulation with an unknown input leads to a file inclusion vulnerability. CWE is classifying the issue as CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.

The weakness was presented by Ruslan Sayfiev and Denis Faiustov as sec-2026-118. The advisory is shared at hitachi.com. This vulnerability is uniquely identified as CVE-2025-65115 since 11/18/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/09/2026).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202604-1402). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Hitachi

Name

• DM Client
• Job Management Partner 1 IT Desktop Management
• JP1 IT Desktop Management 2
• NETM DM Manager
• Software Distribution Client
• Software Distribution Manager

License

• commercial

Website

• Vendor: https://www.hitachi.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion