CVE-2021-1498

CVE-2021-1498 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 1 public exploit from researchers including Nikita Abramov, Mikhail Klyuchnikov, wvu, including a Metasploit module exploits/linux/http/cisco_hyperflex_hx_data_platform_cmd_exec. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated command injection vulnerability in Cisco HyperFlex HX Data Platform's /storfs-asup endpoint, allowing execution of shell commands as the Tomcat user. It supports both direct command execution and staged payload delivery.

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.