CVE-2021-28181: ASUS BMC's firmware: buffer overflow - Remote video configuration setting

Published Apr 6, 2021

Updated

The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected Software

6 affected components

ASUS Z10pr-d16 Firmware=1.14.51

ASUS Z10pr-d16

ASUS Asmb8-ikvm Firmware=1.14.51

ASUS Asmb8-ikvm

ASUS Z10pe-d16 Ws Firmware=1.14.2

ASUS Z10pe-d16 Ws

Remediation

Information

update BMC's firmwares to the following versions: Z10PR-D16 1.16.1 ASMB8-iKVM 1.16.1 Z10PE-D16 WS 1.16.1

Event History

Apr 6, 2021

CVE Published

via MITRE·05:02 AM

Data Sourced

via MITRE·05:02 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-28181?

CVE-2021-28181 is a vulnerability found in ASUS BMC's firmware Web management page that allows remote attackers to perform a buffer overflow attack.

How does CVE-2021-28181 impact ASUS BMC's firmware Web management page?

CVE-2021-28181 allows remote attackers to exploit a buffer overflow vulnerability in the specific function of the firmware Web management page.

What is the severity of CVE-2021-28181?

CVE-2021-28181 has a severity rating of 4.9 (medium).

Which versions of ASUS Z10pr-d16 Firmware are affected by CVE-2021-28181?

ASUS Z10pr-d16 Firmware version 1.14.51 is affected by CVE-2021-28181.

How can I fix CVE-2021-28181?

To fix CVE-2021-28181, it is recommended to update ASUS BMC's firmware to a version that addresses the buffer overflow vulnerability.