CVE-2021-28188

published 2021-04-06

CVE-2021-28188: The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users…

Priority P4 23 medium 4.9 CVSS 3.1

AV N AC L PR H UI N S U C N I N A H

The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
asus	asmb8-ikvm_firmware	—	—
asus	bmc_firmware_for_asmb8-ikvm	—	—
asus	bmc_firmware_for_z10pe-d16_ws	—	—
asus	bmc_firmware_for_z10pr-d16	—	—
asus	z10pe-d16_ws_firmware	—	—
asus	z10pr-d16_firmware	—	—

CVSS provenance

nvd v3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-120