---
id: "CVE-2021-1497"
kind: "vulnerability"
aliases: ["CVE-2021-1497"]
title: "Cisco HyperFlex HX: Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.9993
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco HyperFlex HX", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "exploited", "hyperflex", "infrastructure", "on-prem"]
not_affected_if: ["unknown"]
published_at: "2021-05-06T13:15:10+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1497", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-1497", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1497", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Cisco HyperFlex HX: Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Cisco HyperFlex HX Installer Virtual Machine has an input validation flaw that lets an attacker run commands on the device. The commands run as root, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco HyperFlex HX affected ? fixed ?

## How to check

Identify any HyperFlex HX Installer Virtual Machine in your environment and confirm its Cisco version against the advisory.

## Fix

Apply the Cisco updates per the vendor instructions named in the CISA KEV entry.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1497
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-1497
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-1497

## From the sources

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_