CVE-2021-28185: ASUS BMC's firmware: buffer overflow - ActiveX configuration-1 acquisition

Published Apr 6, 2021

Updated

The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected Software

6 affected components

ASUS Z10pr-d16 Firmware=1.14.51

ASUS Z10pr-d16

ASUS Asmb8-ikvm Firmware=1.14.51

ASUS Asmb8-ikvm

ASUS Z10pe-d16 Ws Firmware=1.14.2

ASUS Z10pe-d16 Ws

Remediation

Information

update BMC's firmwares to the following versions: Z10PR-D16 1.16.1 ASMB8-iKVM 1.16.1 Z10PE-D16 WS 1.16.1

Event History

Apr 6, 2021

CVE Published

via MITRE·05:02 AM

Data Sourced

via MITRE·05:02 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-28185?

CVE-2021-28185 is a vulnerability in ASUS BMC's firmware Web management page that allows remote attackers to execute arbitrary code due to a buffer overflow vulnerability.

How severe is CVE-2021-28185?

CVE-2021-28185 has a severity rating of 4.9, which is considered medium.

Which software versions are affected by CVE-2021-28185?

CVE-2021-28185 affects Asus Z10pr-d16 Firmware version 1.14.51 and Asus Asmb8-ikvm Firmware version 1.14.51.

How can remote attackers exploit CVE-2021-28185?

Remote attackers can exploit CVE-2021-28185 by using a buffer overflow vulnerability to obtain privileged permission and execute arbitrary code.

Are there any official references for CVE-2021-28185?

Yes, you can find more information about CVE-2021-28185 on the ASUS Product Security Advisory page, the ASUS support website, and the Taiwan Computer Emergency Response Team (TW-CERT) website.