CVE-2021-28182: ASUS BMC's firmware: buffer overflow - Web Service configuration function

Published Apr 6, 2021

Updated

The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected Software

6 affected components

ASUS Z10pr-d16 Firmware=1.14.51

ASUS Z10pr-d16

ASUS Asmb8-ikvm Firmware=1.14.51

ASUS Asmb8-ikvm

ASUS Z10pe-d16 Ws Firmware=1.14.2

ASUS Z10pe-d16 Ws

Remediation

Information

update BMC's firmwares to the following versions: Z10PR-D16 1.16.1 ASMB8-iKVM 1.16.1 Z10PE-D16 WS 1.16.1

Event History

Apr 6, 2021

CVE Published

via MITRE·05:02 AM

Data Sourced

via MITRE·05:02 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-28182.

What is the severity level of CVE-2021-28182?

The severity level of CVE-2021-28182 is medium.

Which software versions are affected by CVE-2021-28182?

The ASUS BMC firmware versions 1.14.51 and ASUS Asmb8-ikvm firmware versions 1.14.51 are affected by CVE-2021-28182.

How does the vulnerability in ASUS BMC firmware Web management page occur?

The vulnerability in ASUS BMC firmware Web management page occurs due to a buffer overflow vulnerability in the Web Service configuration function.

How can remote attackers exploit CVE-2021-28182?

Remote attackers can exploit CVE-2021-28182 by using the leakage to abnormally terminate the Web service and obtain privileged permission.