CVE-2021-1498

CRITICALCISA KEV

9.8

Description

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published5/6/2021

Last Modified10/28/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorCisco

ProductHyperFlex HX

Vulnerability NameCisco HyperFlex HX Data Platform Command Injection Vulnerability

KEV Date Added2021-11-03

Remediation Due Date2021-11-17

Ransomware UseUnknown

Affected Products

cisco:hyperflex_hx220c_af_m5cisco:hyperflex_hx220c_all_nvme_m5cisco:hyperflex_hx220c_edge_m5cisco:hyperflex_hx220c_m5cisco:hyperflex_hx240ccisco:hyperflex_hx240c_af_m5cisco:hyperflex_hx240c_m5cisco:hyperflex_hx_data_platform

Weaknesses (CWE)

CWE-78CWE-77

References

http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html(psirt@cisco.com)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR(psirt@cisco.com)

http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1498(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.