CVE-2021-28203

Katalog CVE

CVSS 7.2 · High EPSS 2,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada asus z10pr-d16 firmware, asus asmb8-ikvm firmware +1 lainnya. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.

Rincian

Terbit di NVD

6 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 79,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.asus.com/content/ASUS-Product-Security-Advisory/ advisory vendor
• https://www.asus.com/tw/support/callus/ advisory vendor
• https://www.twcert.org.tw/tw/cp-132-4573-aa336-1.html advisory pihak ketiga