⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2021-11-17. Required action: Apply updates per vendor instructions..

CVE-2021-1497

CWE-78 — OS Command InjectionCWE-416 — Use After Free14 documents10 sources
Severity
9.8CRITICAL
EPSS
94.4%
top 0.04%
CISA KEV
KEV
Added 2021-11-03
Due 2021-11-17
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Cisco Hyperflex HX Data PlatformCisco Cisco Hyperflex HX Data Platform
Timeline
PublishedMay 6
KEV addedNov 3
KEV dueNov 17
Latest updateMay 21
CISA Required Action: Apply updates per vendor instructions.

Description

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/hyperflex_hx_data_platform4.5 — 4.5\(2a\)+1

🔴Vulnerability Details

3
GHSA
GHSA-2hv5-x25m-j674: Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform comman↗2022-05-24
▶
CVEList
Cisco HyperFlex HX Command Injection Vulnerabilities↗2021-05-06
▶
VulnCheck
Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability↗2021
▶

💥Exploits & PoCs

5
Nuclei
Cisco HyperFlex HX Data Platform - Remote Command Execution
▶
Metasploit
Microsoft Exchange ProxyLogon Collector↗
▶
Metasploit
Microsoft Exchange ProxyLogon Scanner↗
▶
Metasploit
Microsoft Exchange ProxyShell RCE↗
▶
Metasploit
Microsoft Exchange ProxyLogon RCE↗
▶

🔍Detection Rules

2
Suricata
ET EXPLOIT Cisco HyperFlex OS Command Injection M1 (CVE-2021-1497)↗2021-09-29
▶
Suricata
ET EXPLOIT Cisco HyperFlex OS Command Injection M2 (CVE-2021-1497)↗2021-09-29
▶

📋Vendor Advisories

3
Red Hat
kernel: f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances↗2024-05-21
▶
CISA
Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability↗2021-11-03
▶
Cisco
Cisco HyperFlex HX Command Injection Vulnerabilities↗2021-05-05
▶