CVE-2021-1499

🗓️ 06 May 2021 12:41:36Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 113 Views🌐 WEB

Vulnerability in Cisco HyperFlex HX Data Platform allows unauthenticated remote file uploa

Reporter	Title	Published	Views	Family All 18
0day.today	Cisco HyperFlex HX Data Platform File Upload / Remote Code Execution Exploit	17 Jun 202100:00	–	zdt
ATTACKERKB	CVE-2021-1499	5 May 202100:00	–	attackerkb
BDU FSTEC	The vulnerability in the web interface for managing data storage systems in Cisco HyperFlex HX Data Platform’s hyper-converged infrastructure allows a malicious actor to upload arbitrary files.	15 Jun 202100:00	–	bdu_fstec
Circl	CVE-2021-1499	6 May 202113:51	–	circl
Cisco	Cisco HyperFlex HX Data Platform File Upload Vulnerability	5 May 202116:00	–	cisco
CNNVD	Cisco HyperFlex HX Data Platform 访问控制错误漏洞	5 May 202100:00	–	cnnvd
CNVD	Cisco HyperFlex HX Data Platform Access Control Error Vulnerability	7 May 202100:00	–	cnvd
Check Point Advisories	Cisco HyperFlex HX Directory Traversal (CVE-2021-1499)	20 Jun 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-1499 Cisco HyperFlex HX Data Platform File Upload Vulnerability	6 May 202112:41	–	cvelist
Metasploit	Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499)	18 Jun 202117:42	–	metasploit

NVD

Node

cisco hyperflex_hx_data_platformRange<4.0(2e)

cisco hyperflex_hx_data_platformRange4.5–4.5(2a)

AND

cisco hyperflex_hx220c_af_m5Match-

cisco hyperflex_hx220c_all_nvme_m5Match-

cisco hyperflex_hx220c_edge_m5Match-

cisco hyperflex_hx220c_m5Match-

cisco hyperflex_hx240cMatch-

cisco hyperflex_hx240c_af_m5Match-

cisco hyperflex_hx240c_m5Match-

[
  {
    "product": "Cisco HyperFlex HX Data Platform",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/163203/Cisco-HyperFlex-HX-Data-Platform-File-Upload-Remote-Code-Execution.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-upload-KtCK8Ugz

Parameter	Position	Path	Description	CWE
x	request body	/upload	Arbitrary file upload via /upload could lead to RCE on affected devices (no authentication).	CWE-306

17 Jun 2026 03:31Current

5.3Medium risk

Vulners AI Score5.3

CVSS 25

CVSS 3.15.3

EPSS0.80426

SSVC

CWE-306