CVE-2021-28186

The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Score

CVSS 3.1 4.9 Medium

Status

Modified - twcert@cert.org.tw

Published

2021-04-06

Last modified

2024-09-16

Weaknesses

CWE-120

Affected products

• Asmb8-ikvm Firmware (Asus)
• Bmc Firmware For Asmb8-ikvm (Asus)
• Bmc Firmware For Z10pe-d16 Ws (Asus)
• Bmc Firmware For Z10pr-d16 (Asus)
• Z10pe-d16 Ws Firmware (Asus)
• Z10pr-d16 Firmware (Asus)

References

• https://www.asus.com/content/ASUS-Product-Security-Advisory/
• https://www.asus.com/tw/support/callus/
• https://www.twcert.org.tw/tw/cp-132-4556-ece3d-1.html