CVE-2021-1498 — Cisco HyperFlex HX Data Platform Command Injection Vulnerability

provenance: imported · CVE: CVE-2021-1498

CVE-2021-1498: Cisco HyperFlex HX Data Platform Command Injection Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Cisco
Product	HyperFlex HX
Date added	2021-11-03
Due date	2021-11-17
Ransomware campaign use	Unknown

Description

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-1498

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-1498
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog