CVE-2021-28204 : Exploit Details and Defense Strategies

A vulnerability in ASUS BMC's firmware allows remote attackers to execute arbitrary commands via command injection. Learn about the impact, affected systems, and mitigation steps.

Understanding CVE-2021-28204

This CVE describes a command injection vulnerability in ASUS BMC's firmware that can be exploited to execute arbitrary commands remotely.

What is CVE-2021-28204?

The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter, enabling attackers with administrator permission to conduct command injections.

The Impact of CVE-2021-28204

The vulnerability has a CVSS base score of 7.2, indicating a high severity issue with significant impacts on confidentiality, integrity, and availability. Attackers can exploit this flaw to gain control over affected systems.

Technical Details of CVE-2021-28204

This section covers the vulnerability description, affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

The vulnerability stems from a lack of parameter filtering in the Modify user’s information function, allowing for unauthorized command execution.

Affected Systems and Versions

BMC firmware for Z10PR-D16 version 1.14.51
BMC firmware for ASMB8-iKVM version 1.14.51
BMC firmware for Z10PE-D16 WS version 1.14.2

Exploitation Mechanism

Remote attackers with administrator privileges can leverage this vulnerability to execute arbitrary commands on the target system.

Mitigation and Prevention

Discover immediate steps to take, long-term security practices, and the importance of patching and updates.

Immediate Steps to Take

Update BMC's firmwares to the following versions:

Z10PR-D16 1.16.1
ASMB8-iKVM 1.16.1
Z10PE-D16 WS 1.16.1

Long-Term Security Practices

Implement network segmentation, restrict access to BMC interfaces, and regularly monitor for unauthorized activities.

Patching and Updates

Stay informed about security advisories from ASUS, apply patches promptly, and conduct regular security audits.