CVE-2021-1498
Published: 06 May 2021
Summary
CVE-2021-1498 is a critical-severity OS Command Injection (CWE-78) vulnerability in Cisco Hyperflex Hx Data Platform. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2021-1498 is a set of command injection vulnerabilities, tracked under CWE-78 and CWE-77, that affect the web-based management interface of Cisco HyperFlex HX. The flaws permit unauthenticated remote attackers to inject and execute arbitrary commands on affected devices, reflected in the maximum CVSS 3.1 base score of 9.8.
An unauthenticated attacker with network access can send specially crafted HTTP requests to the management interface and obtain full command execution, resulting in complete compromise of confidentiality, integrity, and availability without any user interaction.
The Cisco Security Advisory cisco-sa-hyperflex-rce-TjjNrkpR provides remediation guidance and patch information, while the vulnerability is also listed in the CISA Known Exploited Vulnerabilities catalog. Public exploit code demonstrating remote command execution has been published on Packet Storm.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-6965
Vulnerability details
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces authentication and authorization on the HyperFlex web management interface so that unauthenticated remote attackers cannot reach the command-injection entry points.
Requires validation and sanitization of all HTTP input fields that the CVE exploits for command injection (CWE-78/77).
Restricts remote network access to the management interface, reducing the attack surface that allows unauthenticated command execution.