{"id":"CVE-2021-1498","kind":"vulnerability","aliases":["CVE-2021-1498"],"related":[],"title":"Cisco HyperFlex HX: Cisco HyperFlex HX Data Platform Command Injection Vulnerability","description":"Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.","summary":"Cisco HyperFlex HX Installer Virtual Machine has an input validation flaw that lets an attacker run commands on the device as the tomcat8 user. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":0.99999,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Cisco HyperFlex HX","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","hyperflex","infrastructure","on-prem-hci"],"not_affected_if":["no-hyperflex-installer-vm"],"how_to_check":null,"fix":"Apply the updates per Cisco's vendor instructions; the sources do not name a fixed version.","status":"open","published_at":"2021-05-06T13:15:10+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:43:42+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:43:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per Cisco's vendor instructions; the sources do not name a fixed version.","reach":"unknown","impact":"high","summary":"Cisco HyperFlex HX Installer Virtual Machine has an input validation flaw that lets an attacker run commands on the device as the tomcat8 user. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["cisco","hyperflex","on-prem-hci"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the installer VM as tomcat8","analyst_note":"Find Cisco's advisory for CVE-2021-1498 to get affected and fixed versions, the network reach, and whether auth is required; the sources given do not say.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-hyperflex-installer-vm"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000465,"input_tokens":2857,"output_tokens":358,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find Cisco's advisory for CVE-2021-1498 to get affected and fixed versions, the network reach, and whether auth is required; the sources given do not say.","search":"'-1498':14A,17A '-2021':13A,16A 'activ':57B 'advisori':102C 'affect':88C 'allow':76C 'attack':43B,80C,85C 'base':68C 'cisa':53B 'cisco':1A,4A,18A,21B,29B,72C 'command':9A,45B,83C 'could':75C 'cve':12A,15A 'data':7A 'detail':98C 'devic':48B,89C 'exploit':22B,58B 'flaw':39B 'hci':28B 'hx':3A,6A,20A,31B,74C 'hyperflex':2A,5A,19A,23B,30B,73C 'inform':92C 'infrastructur':24B 'inject':10A,84C 'input':37B 'instal':32B 'interfac':70C 'let':41B 'list':54B 'machin':34B 'manag':69C 'multipl':62C 'on-prem-hci':25B 'perform':82C 'platform':8A 'prem':27B 'remot':79C 'run':44B 'section':99C 'see':96C 'tomcat8':51B 'unauthent':78C 'user':52B 'valid':38B 'virtual':33B 'vulner':11A,63C,95C 'web':67C 'web-bas':66C 'wild':61B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-06T13:15:10+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-1498","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1498","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2021-1498","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1498","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-1498","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-1498","severity":null,"published_at":"2021-05-06T13:15:10+00:00","modified_at":"2026-06-17T03:31:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}