peter bassill · operator
$ cve CVE-2021-1498 JSON

CVE-2021-1498 KEV

9.8
CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2021-11-17.

Description

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS100% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2021-11-17
Public exploitnone known
Published2021-05-06
Last modified2026-06-17

CISA KEV

NameCisco HyperFlex HX Data Platform Command Injection Vulnerability
Added2021-11-03
Due2021-11-17
Vendor / productCisco / HyperFlex HX
Ransomware usenone reported

Affected (8)

VendorProduct
ciscohyperflex hx data platform
ciscohyperflex hx220c af m5
ciscohyperflex hx220c all nvme m5
ciscohyperflex hx220c edge m5
ciscohyperflex hx220c m5
ciscohyperflex hx240c
ciscohyperflex hx240c af m5
ciscohyperflex hx240c m5

References

→ the Explorer  ·  watch your stack  ·  NVD