The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
References
| Link | Resource |
|---|---|
| https://www.asus.com/content/ASUS-Product-Security-Advisory/ | Vendor Advisory |
| https://www.asus.com/tw/support/callus/ | Vendor Advisory |
| https://www.twcert.org.tw/tw/cp-132-4573-aa336-1.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
14 Apr 2021, 12:02
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 | |
| References | (CONFIRM) https://www.asus.com/tw/support/callus/ - Vendor Advisory | |
| References | (CONFIRM) https://www.twcert.org.tw/tw/cp-132-4573-aa336-1.html - Third Party Advisory | |
| References | (CONFIRM) https://www.asus.com/content/ASUS-Product-Security-Advisory/ - Vendor Advisory | |
| CPE | cpe:2.3:o:asus:z10pe-d16_ws_firmware:1.14.2:*:*:*:*:*:*:* cpe:2.3:h:asus:z10pe-d16_ws:-:*:*:*:*:*:*:* cpe:2.3:h:asus:asmb8-ikvm:-:*:*:*:*:*:*:* cpe:2.3:h:asus:z10pr-d16:-:*:*:*:*:*:*:* cpe:2.3:o:asus:z10pr-d16_firmware:1.14.51:*:*:*:*:*:*:* cpe:2.3:o:asus:asmb8-ikvm_firmware:1.14.51:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 7.2 |
06 Apr 2021, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-04-06 05:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-28203
Mitre link : CVE-2021-28203
CVE.ORG link : CVE-2021-28203
JSON object : View
Products Affected
asus
- z10pr-d16_firmware
- z10pe-d16_ws
- asmb8-ikvm
- z10pe-d16_ws_firmware
- z10pr-d16
- asmb8-ikvm_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')