CVE-2021-1497 Cisco HyperFlex HX Installer Virtual Machine Command Injection
Unauthenticated remote attackers can execute arbitrary commands on Cisco HyperFlex HX devices via the web management interface.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-1497?
CVE-2021-1497 is a critical command injection vulnerability in Cisco HyperFlex HX Data Platform, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Weakness: CWE-78
Which versions are affected by CVE-2021-1497?
It affects 1 product.
Products include Cisco Hyperflex Hx Data Platform.
How do I fix CVE-2021-1497?
No fix has been published for CVE-2021-1497 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-1497 being exploited?
Yes. Attackers have exploited CVE-2021-1497 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Cisco HyperFlex HX Data Platform
- CVE-2021-1498 Cisco HyperFlex HX Data Platform Command Injection
- CVE-2018-15380 Cisco HyperFlex Software Command Injection Vulnerability
- CVE-2018-15382 Cisco HyperFlex Software Static Signing Key Vulnerability
- CVE-2019-1664 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
- CVE-2017-12315 Information disclosure in Cisco HyperFlex System
Sources
Also known as GHSA-2hv5-x25m-j674.