CVE-2021-1499

Cisco HyperFlex HX Data Platform File Upload Vulnerability

MEDIUM

5.3

CVSS Score

Published: May 6, 2021 at 12:41 PM UTC

Updated: June 17, 2026 at 03:31 AM UTC

8 products affected across 1 vendorHyperflex Hx Data PlatformHyperflex Hx220C M5Hyperflex Hx220C Edge M5

Using Cisco HyperFlex HX Data Platform by Cisco?

Get instant alerts when new vulnerabilities affect Cisco HyperFlex HX Data Platform - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 80%

SSVC

No known exploit

Description

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerability by sending a specific HTTP request to an affected device. A successful exploit could allow the attacker to upload files to the affected device with the permissions of the tomcat8 user.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Hyperflex Hx Data Platform · Cisco

95%

v < 4.0(2e)4.5 ≤ v < 4.5(2a)

Affected range stops below 4.0(2e), so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5(2a), so it looks safe — our inference, not a vendor statement

cisco-hyperflex-hx220c-af-m5 (environment) · cisco-hyperflex-hx220c-all-nvme-m5 (environment) · cisco-hyperflex-hx220c-edge-m5 (environment) · cisco-hyperflex-hx220c-m5 (environment) · cisco-hyperflex-hx240c (environment) · cisco-hyperflex-hx240c-af-m5 (environment) · cisco-hyperflex-hx240c-m5 (environment)

Hyperflex Hx220C Af M5 · Ciscodevice

80%

All versions

Hyperflex Hx220C All Nvme M5 · Ciscodevice

80%

All versions

Hyperflex Hx220C Edge M5 · Ciscodevice

80%

All versions

Hyperflex Hx220C M5 · Ciscodevice

80%

All versions