CVE-2021-28178: ASUS BMC's firmware: buffer overflow - UEFI configuration function
Published Apr 6, 2021
·Updated
The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Affected Software
6 affected components
ASUS Z10pr-d16 Firmware=1.14.51
ASUS Z10pr-d16
ASUS Asmb8-ikvm Firmware=1.14.51
ASUS Asmb8-ikvm
ASUS Z10pe-d16 Ws Firmware=1.14.2
ASUS Z10pe-d16 Ws
Remediation
Information
update BMC's firmwares to the following versions:
Z10PR-D16 1.16.1
ASMB8-iKVM 1.16.1
Z10PE-D16 WS 1.16.1
Event History
Apr 6, 2021
CVE Published
via MITRE·05:02 AM
Data Sourced
via MITRE·05:02 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2021-28178?
CVE-2021-28178 is a Buffer overflow vulnerability in the UEFI configuration function of ASUS BMC's firmware Web management page.
2
What is the severity of CVE-2021-28178?
The severity of CVE-2021-28178 is medium with a CVSS score of 4.9.
3
How does CVE-2021-28178 affect ASUS Z10pr-d16 Firmware?
ASUS Z10pr-d16 Firmware version 1.14.51 is affected by CVE-2021-28178.
4
How does CVE-2021-28178 affect ASUS Asmb8-ikvm Firmware?
ASUS Asmb8-ikvm Firmware version 1.14.51 is affected by CVE-2021-28178.
5
What actions can remote attackers take with CVE-2021-28178?
Remote attackers can use the vulnerability to obtain privileged permission and abnormally terminate the Web service.