Cisco HyperFlex HX Command Injection Vulnerabilities (CVE-2021-1498)

What is affected, what to do

This vulnerability allows an unauthenticated, remote attacker to execute commands on an affected device by exploiting insufficient input validation in the Cisco HyperFlex HX Installer Virtual Machine. The vulnerability is actively exploited in the wild, including in ransomware campaigns. It affects specific versions of the Cisco HyperFlex HX Data Platform, particularly versions 4.0(2e) and 4.5 to 4.5(2a). An immediate update to the latest available version is critical to mitigate the risk. The vulnerability is identified as CVE-2021-1498 and is listed in the CISA KEV catalog.

The vulnerability is being actively exploited; treat it as a priority. Update Cisco HyperFlex HX-Series to version 4.0\(2e\), Cisco HyperFlex HX-Series to version 4.5\(2a\). Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Cisco HyperFlex HX-Series lt *..4.0\(2e\)
• Cisco HyperFlex HX-Series lt 4.5..4.5\(2a\)

Fixed in

• Cisco HyperFlex HX-Series 4.0\(2e\)
• Cisco HyperFlex HX-Series 4.5\(2a\)

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade Cisco HyperFlex HX Data Platform to a fixed release: at least 4.0(2e) on the 4.0 branch or 4.5(2a) on the 4.5 branch. The 3.5 and 3.0 branches are end-of-support per the Cisco advisory — plan a migration path onto a maintained branch.
   • Remove the HyperFlex HX Installer web management interface (TCP/443, TCP/80) from any untrusted network. Restrict access to a dedicated admin VLAN or jump host with MFA, and block external reachability at the perimeter firewall immediately.
   • Identify the Installer VM and, where operationally acceptable, power it down or isolate it when it is not actively needed for deployment. The Installer VM is often forgotten after initial cluster setup and is a classic stale attack surface.
   • Inspect running processes under the tomcat8 user on all HyperFlex appliances for anomalous child processes (sh, bash, curl, wget, python, nc) and trigger incident response on any hit, taking a forensic snapshot before any reboot.
   • Rotate local credentials, SSH keys and API tokens on affected HX nodes unless compromise can be cleanly excluded — the vulnerability allows unauthenticated remote code execution.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place the HyperFlex management network in a dedicated VLAN with strict ACLs. Inbound only SSH/HTTPS from defined admin hosts, no direct outbound Internet access. Never share a flat management LAN with production workloads.
   • Put a WAF or reverse proxy in front of the HyperFlex web UI and block requests carrying shell metacharacters (;, |, `, $(, &&, %0a) in URL path, query string or POST body. Enforce method and endpoint allow-listing (GET/POST on known paths only).
   • Suricata/Snort rule on HTTP traffic to HyperFlex IPs: alert and drop payloads containing encoded shell separators or common command-injection fragments such as ;id, ;uname, /bin/sh, base64 -d.
   • Endpoint hardening on the Installer VM: run tomcat8 with the minimum privilege profile, enable AppArmor/SELinux policies, tighten the host-level egress firewall (iptables/nftables) so the VM cannot initiate connections outside required repositories.
   • IAM / least privilege: reduce the service accounts used by the HyperFlex Installer against vCenter or AD to the strict minimum. Never cache Domain Admin credentials in Installer configuration.
   • Configuration hardening: change default appliance credentials, disable unused services (SNMP v1/v2c, Telnet, HTTP redirects), enforce certificate validation on management connections.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry detection (Sysmon EID 1 or auditd execve): tomcat8 or java as parent of sh, bash, curl, wget, nc or python is not normal on a HyperFlex Installer VM. Sigma shape: parent_image endswith '/java' AND image in ('/bin/sh','/bin/bash','/usr/bin/curl','/usr/bin/wget').
   • Tomcat access logs (localhost_access_log.*): POST/GET on Installer endpoints containing URL-decoded shell metacharacters or unusually long query strings. Splunk shape: index=hyperflex sourcetype=tomcat:access uri_query IN ("*;*","*|*","*%60*","*%24%28*").
   • Auditd on the VM: new outbound TCP connections initiated by the tomcat8 UID (-a always,exit -F arch=b64 -S connect -F uid=tomcat8) — any egress beyond expected backend services is suspicious.
   • Network telemetry (Zeek conn.log/http.log): HTTP requests to the HX management IP from non-admin source IPs; also reverse-shell-like outbound connects (unusual high ports, TLS to unknown SNI).
   • Filesystem monitoring: creation of files under /tmp, /var/tmp or within the tomcat webapps directory by the tomcat8 user, especially with .sh, .jsp, .war extensions or no extension at all (potential webshells or droppers).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• Cisco Cisco HyperFlex HX-Series

Weakness classes (CWE)

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  Base

  The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

  Entry at MITRE CWE-78

References & sources

• tools.cisco.com20210505 Cisco HyperFlex HX Command Injection VulnerabilitiesVendor advisory, x_refsource_CISCO, Vendor advisory
• packetstormsecurity.comfiles/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1498government-resource, US government resource