The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
References
| Link | Resource |
|---|---|
| https://www.asus.com/content/ASUS-Product-Security-Advisory/ | Vendor Advisory |
| https://www.asus.com/tw/support/callus/ | Vendor Advisory |
| https://www.twcert.org.tw/tw/cp-132-4574-b61a6-1.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
14 Apr 2021, 12:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://www.asus.com/tw/support/callus/ - Vendor Advisory | |
| References | (CONFIRM) https://www.twcert.org.tw/tw/cp-132-4574-b61a6-1.html - Third Party Advisory | |
| References | (CONFIRM) https://www.asus.com/content/ASUS-Product-Security-Advisory/ - Vendor Advisory | |
| CWE | CWE-78 | |
| CPE | cpe:2.3:o:asus:z10pe-d16_ws_firmware:1.14.2:*:*:*:*:*:*:* cpe:2.3:h:asus:z10pe-d16_ws:-:*:*:*:*:*:*:* cpe:2.3:h:asus:asmb8-ikvm:-:*:*:*:*:*:*:* cpe:2.3:h:asus:z10pr-d16:-:*:*:*:*:*:*:* cpe:2.3:o:asus:z10pr-d16_firmware:1.14.51:*:*:*:*:*:*:* cpe:2.3:o:asus:asmb8-ikvm_firmware:1.14.51:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 7.2 |
06 Apr 2021, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-04-06 05:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-28204
Mitre link : CVE-2021-28204
CVE.ORG link : CVE-2021-28204
JSON object : View
Products Affected
asus
- z10pr-d16
- z10pr-d16_firmware
- asmb8-ikvm
- z10pe-d16_ws_firmware
- asmb8-ikvm_firmware
- z10pe-d16_ws
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')