9.8Crítica
KEV
CVE-2021-1497Cisco HyperFlex HX Command Injection Vulnerabilities
Explotación conocida — Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability
CISA confirmó el 03.11.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 17.11.2021.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-1497
Descripción
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Debilidad (CWE):
CWE-78
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Cisco | Cisco HyperFlex HX Data Platform | — | |
| cisco | hyperflex hx data platform | < 4.0\(2e\) |
Referencias y parches
- 20210505 Cisco HyperFlex HX Command Injection Vulnerabilities vendor-advisoryVendor Advisory
- http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1497 US Government Resource
Coincidencias CPE (NVD) (2)
cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:*< 4.0\(2e\)cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:*≥ 4.5 < 4.5\(2a\)