Unrated severityNVD Advisory· Published Apr 6, 2021· Updated Sep 16, 2024

ASUS BMC's firmware: command injection - Web Set Media Image function

CVE-2021-28203

Description

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Supermicro/Bmcllm-fuzzy
ASUS/BMC firmware for ASMB8-iKVMv5
Range: 1.14.51
ASUS/BMC firmware for Z10PE-D16 WSv5
Range: 1.14.2
ASUS/BMC firmware for Z10PR-D16v5
Range: 1.14.51

Patches

Vulnerability mechanics

References

www.asus.com/content/ASUS-Product-Security-Advisory/mitrex_refsource_MISC
www.asus.com/tw/support/callus/mitrex_refsource_MISC
www.twcert.org.tw/tw/cp-132-4573-aa336-1.htmlmitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000