CVE-2021-28182
published 2021-04-06CVE-2021-28182: The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer…
medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asus | asmb8-ikvm_firmware | — | — |
| asus | bmc_firmware_for_asmb8-ikvm | — | — |
| asus | bmc_firmware_for_z10pe-d16_ws | — | — |
| asus | bmc_firmware_for_z10pr-d16 | — | — |
| asus | z10pe-d16_ws_firmware | — | — |
| asus | z10pr-d16_firmware | — | — |