CVE-2021-28203

published 2021-04-06

CVE-2021-28203: The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission…

Priority P3 47 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
asus	asmb8-ikvm_firmware	—	—
asus	bmc_firmware_for_asmb8-ikvm	—	—
asus	bmc_firmware_for_z10pe-d16_ws	—	—
asus	bmc_firmware_for_z10pr-d16	—	—
asus	z10pe-d16_ws_firmware	—	—
asus	z10pr-d16_firmware	—	—

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78