CVE-2021-28204

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-282054.9The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As CVE-2021-282064.9The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obt CVE-2021-282074.9The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaini CVE-2021-282084.9The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtain CVE-2021-282094.9The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obt CVE-2021-282107.8An unlimited recursion in DxeCore in EDK II.CVE-2021-282116.7A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.CVE-2021-282137.5Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.CVE-2021-282167.8BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.CVE-2021-282338.8Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c.CVE-2021-282359.8Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.CVE-2021-282367.5LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c.