Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

CRITICO 9.8EXPLOITED (CISA KEV)CVE-2021-1497 · Published 06/05/2021 · updated 17/06/2026

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

In breve

CVE-2021-1497 è una vulnerabilità CRITICO (CVSS 9.8).
Sfruttata attivamente: la CISA l'ha aggiunta al catalogo KEV il 03/11/2021.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 99.9%, superiore al 100.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
HyperFlex HX Cisco	Versions not published yet (product named by CISA KEV)

Description

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

References

packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html · Exploit
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-1497

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free