{"id":"CVE-2021-1497","kind":"vulnerability","aliases":["CVE-2021-1497"],"related":[],"title":"Cisco HyperFlex HX: Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability","description":"Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.","summary":"Cisco HyperFlex HX Installer Virtual Machine has an input validation flaw that lets an attacker run commands on the device. The commands run as root, and CISA lists it as actively exploited.","severity":"critical","cvss":10.0,"epss":0.9993,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Cisco HyperFlex HX","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","hyperflex","infrastructure","on-prem"],"not_affected_if":["unknown"],"how_to_check":"Identify any HyperFlex HX Installer Virtual Machine in your environment and confirm its Cisco version against the advisory.","fix":"Apply the Cisco updates per the vendor instructions named in the CISA KEV entry.","status":"open","published_at":"2021-05-06T13:15:10+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:49+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:33:49Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco updates per the vendor instructions named in the CISA KEV entry.\nunknown","reach":"unknown","impact":"high","summary":"Cisco HyperFlex HX Installer Virtual Machine has an input validation flaw that lets an attacker run commands on the device. The commands run as root, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["cisco","hyperflex","on-prem"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands as root on the installer VM.","analyst_note":"Get affected and fixed versions and the Cisco advisory ID from the Cisco security advisories page for CVE-2021-1497, and confirm the attack vector and whether authentication is needed.","how_to_check":"Identify any HyperFlex HX Installer Virtual Machine in your environment and confirm its Cisco version against the advisory.\nunknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000483,"input_tokens":2857,"output_tokens":395,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1497':15A,18A '-2021':14A,17A 'activ':59B 'advisori':101C 'affect':87C 'allow':75C 'attack':43B,79C,84C 'base':67C 'cisa':55B 'cisco':1A,4A,19A,22B,29B,71C 'command':10A,45B,50B,82C 'could':74C 'cve':13A,16A 'detail':97C 'devic':48B,88C 'exploit':23B,60B 'flaw':39B 'hx':3A,6A,21A,31B,73C 'hyperflex':2A,5A,20A,24B,30B,72C 'inform':91C 'infrastructur':25B 'inject':11A,83C 'input':37B 'instal':7A,32B 'interfac':69C 'let':41B 'list':56B 'machin':9A,34B 'manag':68C 'multipl':61C 'on-prem':26B 'perform':81C 'prem':28B 'remot':78C 'root':53B 'run':44B,51B 'section':98C 'see':95C 'unauthent':77C 'valid':38B 'virtual':8A,33B 'vulner':12A,62C,94C 'web':66C 'web-bas':65C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-06T13:15:10+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-1497","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1497","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T20:35:38+00:00","note":null},{"source":"epss","external_id":"CVE-2021-1497","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1497","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-1497","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-1497","severity":null,"published_at":"2021-05-06T13:15:10+00:00","modified_at":"2026-06-17T03:31:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}