CVE-2021-28203

CWE-78 — OS Command Injection3 documents3 sources
Severity
7.2HIGH
EPSS
1.7%
top 17.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Asus BMC Firmware FOR Asmb8-ikvmAsus BMC Firmware FOR Z10pe-d16 WSAsus BMC Firmware FOR Z10pr-d16+3 more
Timeline
PublishedApr 6
Latest updateMay 24

Description

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages6 packages

🔴Vulnerability Details

2
GHSA
GHSA-7rr8-p2fq-c2h8: The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter↗2022-05-24
▶
CVEList
ASUS BMC's firmware: command injection - Web Set Media Image function↗2021-04-06
▶