← Voltar para CVEs
CVE-2021-28204
HIGH7.2
Descricao
The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
Detalhes CVE
Pontuacao CVSS v3.17.2
SeveridadeHIGH
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosHIGH
Interacao do usuarioNONE
Publicado4/6/2021
Ultima modificacao11/21/2024
Fontenvd
Avistamentos honeypot0
Produtos afetados
asus:asmb8-ikvmasus:asmb8-ikvm_firmwareasus:z10pe-d16_wsasus:z10pe-d16_ws_firmwareasus:z10pr-d16asus:z10pr-d16_firmware
Fraquezas (CWE)
CWE-78CWE-78
Referencias
https://www.asus.com/content/ASUS-Product-Security-Advisory/(twcert@cert.org.tw)
https://www.asus.com/tw/support/callus/(twcert@cert.org.tw)
https://www.twcert.org.tw/tw/cp-132-4574-b61a6-1.html(twcert@cert.org.tw)
https://www.asus.com/content/ASUS-Product-Security-Advisory/(af854a3a-2127-422b-91ae-364da2661108)
https://www.asus.com/tw/support/callus/(af854a3a-2127-422b-91ae-364da2661108)
https://www.twcert.org.tw/tw/cp-132-4574-b61a6-1.html(af854a3a-2127-422b-91ae-364da2661108)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.