Critical severity · published May 6, 2021
CVE-2021-1497
Cisco HyperFlex HX Command Injection Vulnerabilities
In wildKEV
9.8
CVSS
99.9%
EPSS
Yes
On KEV
Description
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.9% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueNov 17, 2021
Ransomware campaign useNot known
Affected products
Which versions
CH
Cisco HyperFlex HX Data Platform · Cisco
All versions, or not specified · source: vendor
HH
Hyperflex HX Data Platform · Cisco
before 4.0\(2e\); 4.5 before 4.5\(2a\) · source: NVD
HH
HyperFlex HX · Cisco
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-1497
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-1497
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR
x_refsource_MISC
http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html
More from Cisco HyperFlex HX Data Platform
9.8
CVE-2021-1498
Cisco HyperFlex HX Command Injection Vulnerabilities
6.1
CVE-2023-20263
A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web…