Cisco HyperFlex Software Command Injection Vulnerability

Vulnerability

The vulnerability resides in the cluster service manager of Cisco HyperFlex Software releases prior to 3.5(2a). It stems from insufficient input validation, allowing an unauthenticated, adjacent attacker to inject commands into the bound process [1].

Exploitation

An attacker can exploit this vulnerability by connecting to the cluster service manager from an adjacent network position and injecting commands into the bound process. No authentication is required, and the attack is conducted over the network without user interaction [1].

Impact

Successful exploitation enables the attacker to execute arbitrary commands on the affected host as the root user, resulting in full compromise of confidentiality, integrity, and availability [1].

Mitigation

Cisco fixed this vulnerability in release 3.5(2a) of Cisco HyperFlex Software. Customers are advised to upgrade to the fixed version or later. No workarounds are available [1].