Cisco HyperFlex HX Data Platform vulnerabilities

15 CVEs affecting Cisco HyperFlex HX Data Platform, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20263, published 2023-09-06.

More from Cisco.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-1498: Cisco HyperFlex HX Data Platform Command Injection Vulnerability, published 2021-05-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.…
• CVE-2021-1497: Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability, published 2021-05-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.…
• CVE-2021-1499, published 2021-05-06. Medium severity, CVSS 5.3. EPSS: 80.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is…
• CVE-2019-1666, published 2019-02-21. Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to…
• CVE-2018-15382, published 2018-10-05. High severity, CVSS 8.6. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due to a static signing key that is present…
• CVE-2018-15380, published 2019-02-20. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to…
• CVE-2018-15429, published 2018-10-05. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the web-based UI of Cisco HyperFlex HX Data Platform Software could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The…
• CVE-2019-1665, published 2019-02-21. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the…
• CVE-2018-15423, published 2018-10-05. Medium severity, CVSS 4.7. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the web UI of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to…
• CVE-2019-1958, published 2019-08-08. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected…

Latest

• CVE-2023-20263, published 2023-09-06. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This…
• CVE-2019-1667, published 2019-02-21. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to…
• CVE-2019-1664, published 2019-02-21. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to…