Actively exploited in the wild
Cisco HyperFlex HX Data Platform Command Injection Vulnerability
Cisco - HyperFlex HX · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-1498
CriticalCVSS 9.8KEVSummary
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information, see the Details section of the advisory.
Risk Assessment
A remote attacker could inject and execute arbitrary commands on the device, potentially leading to full system compromise and data confidentiality breaches.
Recommendation
Apply the security updates specified in the Cisco advisory for Cisco HyperFlex HX. Restrict access to the web management interface to trusted networks.
Other vulnerabilities in Cisco HyperFlex HX
Original NVD description (English source)
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.