9.8Critical
KEV
CVE-2021-1498Cisco HyperFlex HX Command Injection Vulnerabilities
Known exploited — Cisco HyperFlex HX Data Platform Command Injection Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 17.11.2021.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-1498
Description
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Cisco | Cisco HyperFlex HX Data Platform | — | |
| cisco | hyperflex hx data platform | < 4.0\(2e\) |
References and patches
- 20210505 Cisco HyperFlex HX Command Injection Vulnerabilities vendor-advisoryVendor Advisory
- http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1498 US Government Resource
CPE matches (NVD) (2)
cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:*< 4.0\(2e\)cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:*≥ 4.5 < 4.5\(2a\)