CVE-2021-29645
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with...
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
- Record
CVE-2021-29645- CVSS 3.1
- 7.0 High
CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2021-16121
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
- Record
EUVD-2021-16121- CVSS 3.1
- 7.0 High
CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4v64-3g6p-jfw6
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with...
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
- Record
GHSA-4v64-3g6p-jfw6- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
NVD
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
- Record
CVE-2021-29645- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
Affected products
- hitachi it operations director
- hitachi job management partner 1\/it desktop management-manager
- hitachi job management partner 1\/it desktop management 2-manager
- hitachi job management partner 1\/remote control agent
- hitachi job management partner 1\/software distribution client
- hitachi job management partner 1\/software distribution manager
- hitachi jp1\/it desktop management-manager
- hitachi jp1\/it desktop management 2-manager
- hitachi jp1\/it desktop management 2-operations director
- hitachi jp1\/netm\/dm client
- hitachi jp1\/netm\/dm client-remote control feature
- hitachi jp1\/netm\/dm manager
Show 2 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29645 is a high vulnerability (CVSS 7.0) in Hitachi It Operations Director, published October 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.