EXPOSURES › CVE-2021-1497
CVE-2021-1497
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco HyperFlex HX installer VM suffered a command injection flaw allowing root-level code execution.
An insufficient input validation flaw in the Cisco HyperFlex HX Installer Virtual Machine allowed attackers to execute arbitrary commands as root. This remote code execution (RCE) vulnerability is actively exploited in the wild and compromises the integrity of hyperconverged infrastructure, requiring immediate patching and validation of deployment artifacts.
Shame score — A high-severity RCE in a critical infrastructure appliance was actively exploited in the wild, indicating a failure to patch known vulnerabilities and insufficient input validation in deployment components.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.
"Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user."
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |