{"id":"CVE-2021-1498","state":"PUBLISHED","title":"Cisco HyperFlex HX Command Injection Vulnerabilities","description":"Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.","publishedAt":"2021-05-06T12:41:31.982Z","updatedAt":"2025-10-21T23:25:47.170Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco HyperFlex HX Data Platform"],"affected":[{"vendor":"Cisco","product":"Cisco HyperFlex HX Data Platform","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR","http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1498"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T19:47:52.848Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/1xxx/CVE-2021-1498.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-1498","state":"PUBLISHED","datePublished":"2021-05-06T12:41:31.982Z","dateUpdated":"2025-10-21T23:25:47.170Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2020-11-13T00:00:00.000Z"},"containers":{"cna":{"title":"Cisco HyperFlex HX Command Injection Vulnerabilities","descriptions":[{"lang":"en","value":"Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}],"affected":[{"vendor":"Cisco","product":"Cisco HyperFlex HX Data Platform","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR","name":"20210505 Cisco HyperFlex HX Command Injection Vulnerabilities","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisco","dateUpdated":"2021-06-04T15:06:14.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633"},"datePublic":"2021-05-05T00:00:00.000Z","exploits":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory."}],"source":{"advisory":"cisco-sa-hyperflex-rce-TjjNrkpR","defect":[["CSCvx36014","CSCvx36019","CSCvx37435"]],"discovery":"INTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2021-05-05T16:00:00","ID":"CVE-2021-1498","STATE":"PUBLIC","TITLE":"Cisco HyperFlex HX Command Injection Vulnerabilities"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco HyperFlex HX Data Platform","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}]},"exploit":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory."}],"impact":{"cvss":{"baseScore":"9.8","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-78"}]}]},"references":{"reference_data":[{"name":"20210505 Cisco HyperFlex HX Command Injection Vulnerabilities","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR"},{"name":"http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html"}]},"source":{"advisory":"cisco-sa-hyperflex-rce-TjjNrkpR","defect":[["CSCvx36014","CSCvx36019","CSCvx37435"]],"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR","name":"20210505 Cisco HyperFlex HX Command Injection Vulnerabilities","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]},{"url":"http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T16:11:17.601Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1498","tags":["government-resource"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-1498","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-11-08T15:51:49.397206Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2021-11-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1498"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T23:25:47.170Z"},"timeline":[{"time":"2021-11-03T00:00:00.000Z","lang":"en","value":"CVE-2021-1498 added to CISA KEV"}]}]}}}