CVE-2021-28203

HIGH

ASUS BMC Firmware - Authenticated OS Command Injection via Web Set Media Image Parameter

Title source: llm
STIX 2.1

Description

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://www.asus.com/tw/support/callus/
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-4573-aa336-1.html

Scores

CVSS v3 7.2
EPSS 0.0577
EPSS Percentile 90.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (3)
asus/asmb8-ikvm_firmware 1.14.51
asus/z10pe-d16_ws_firmware 1.14.2
asus/z10pr-d16_firmware 1.14.51
Published Apr 06, 2021
Tracked Since Feb 18, 2026