CVE-2021-1497criticalunder attackCWE-78

CVE-2021-1497: critical vulnerability in Cisco HyperFlex HX Data Platform

Cisco HyperFlex HX Command Injection Vulnerabilities

Published · Updated

Follow this CVE+ Monitor Cisco HyperFlex HX-Series+ Monitor Cisco HyperFlex HX Data Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon586 days
Published on NVDMay 6
1st PoC+586d
metasploitMay 5
CISA KEV+181d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

The web interface of Cisco HyperFlex HX systems contains a flaw that allows attackers to inject and execute arbitrary commands on the device without needing to log in. This is critical because it gives complete control over the infrastructure to anyone who finds the vulnerable system online.

Technical detail

An unauthenticated remote attacker can exploit command injection vulnerabilities (CWE-78) in the web-based management interface of Cisco HyperFlex HX to execute arbitrary operating system commands. The vulnerability requires network access to the management interface but no authentication, allowing full system compromise with CVSS 9.8 severity.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco HyperFlex HX Data Platform
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco HyperFlex HX Data Platform

In the same product, most dangerous first.

CVE-2021-1498CRITICALCisco HyperFlex HX Command Injection VulnerabilitiesEPSS 100.0%KEVCVE-2021-1499MEDIUMCisco HyperFlex HX Data Platform File Upload VulnerabilityEPSS 80.0%CVE-2018-15429—Cisco HyperFlex HX Data Platform Software Unauthorized Directory Access VulnerabilityEPSS 1.1%CVE-2023-20263MEDIUMCVE-2023-20263EPSS 0.6%CVE-2020-3389MEDIUMCisco Hyperflex HX-Series Software Weak Storage VulnerabilityEPSS 0.2%