CVE-2021-28177
published 2021-04-06CVE-2021-28177: The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow…
medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asus | asmb8-ikvm_firmware | — | — |
| asus | bmc_firmware_for_asmb8-ikvm | — | — |
| asus | bmc_firmware_for_z10pe-d16_ws | — | — |
| asus | bmc_firmware_for_z10pr-d16 | — | — |
| asus | z10pe-d16_ws_firmware | — | — |
| asus | z10pr-d16_firmware | — | — |