CVEvulnerability

CVE-2021-1498

9.8 CRITICAL Known exploited Published 2021-05-06 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Cisco HyperFlex HX Data Platform Command Injection Vulnerability — Cisco HyperFlex HX

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.

Added to KEV
2021-11-03
Remediation due
2021-11-17
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2021-1498
Status
Analyzed
Published
2021-05-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-77, CWE-78

Description

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Affected configurations

• cisco hyperflex hx data platform (< 4.0\(2e\)) • cisco hyperflex hx data platform (>= 4.5 < 4.5\(2a\))

Related

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References