CVE-2021-28204

HIGH

ASUS BMC Firmware - Authenticated OS Command Injection via User Information Parameter

Title source: llm
STIX 2.1

Description

The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://www.asus.com/tw/support/callus/
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-4574-b61a6-1.html

Scores

CVSS v3 7.2
EPSS 0.0577
EPSS Percentile 90.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (3)
asus/asmb8-ikvm_firmware 1.14.51
asus/z10pe-d16_ws_firmware 1.14.2
asus/z10pr-d16_firmware 1.14.51
Published Apr 06, 2021
Tracked Since Feb 18, 2026