CVE-2021-28176: ASUS BMC's firmware: buffer overflow - DNS configuration function

Published Apr 6, 2021

Updated

The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected Software

6 affected components

ASUS Z10pr-d16 Firmware=1.14.51

ASUS Z10pr-d16

ASUS Asmb8-ikvm Firmware=1.14.51

ASUS Asmb8-ikvm

ASUS Z10pe-d16 Ws Firmware=1.14.2

ASUS Z10pe-d16 Ws

Remediation

Information

update BMC's firmwares to the following versions: Z10PR-D16 1.16.1 ASMB8-iKVM 1.16.1 Z10PE-D16 WS 1.16.1

Event History

Apr 6, 2021

CVE Published

via MITRE·05:01 AM

Data Sourced

via MITRE·05:01 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-28176?

CVE-2021-28176 is a Buffer Overflow vulnerability in the DNS configuration function of ASUS BMC's firmware Web management page.

What is the severity of CVE-2021-28176?

CVE-2021-28176 has a severity rating of 4.9 (medium).

Which software versions are affected by CVE-2021-28176?

ASUS Z10pr-d16 Firmware version 1.14.51 and ASUS Asmb8-ikvm Firmware version 1.14.51 are affected.

How can CVE-2021-28176 be exploited?

Remote attackers can exploit CVE-2021-28176 by obtaining privileged permission and using the buffer overflow vulnerability to abnormally terminate the Web service.

Where can I find more information about CVE-2021-28176?

You can find more information about CVE-2021-28176 on the ASUS Product Security Advisory page, the ASUS support website, and the Taiwan Computer Emergency Response Team website.