CVE-2021-28187: ASUS BMC's firmware: buffer overflow - Generate new SSL certificate

Published Apr 6, 2021

Updated

The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected Software

6 affected components

ASUS Z10pr-d16 Firmware=1.14.51

ASUS Z10pr-d16

ASUS Asmb8-ikvm Firmware=1.14.51

ASUS Asmb8-ikvm

ASUS Z10pe-d16 Ws Firmware=1.14.2

ASUS Z10pe-d16 Ws

Remediation

Information

update BMC's firmwares to the following versions: Z10PR-D16 1.16.1 ASMB8-iKVM 1.16.1 Z10PE-D16 WS 1.16.1

Event History

Apr 6, 2021

CVE Published

via MITRE·05:02 AM

Data Sourced

via MITRE·05:02 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-28187?

CVE-2021-28187 is a vulnerability in the ASUS BMC's firmware Web management page that allows remote attackers to cause a buffer overflow and terminate the Web server.

What is the severity of CVE-2021-28187?

CVE-2021-28187 has a severity rating of 4.9 which is considered medium.

Which software versions are affected by CVE-2021-28187?

CVE-2021-28187 affects Asus Z10pr-d16 Firmware version 1.14.51 and Asus Asmb8-ikvm Firmware version 1.14.51.

How can remote attackers exploit CVE-2021-28187?

Remote attackers can exploit CVE-2021-28187 by using a buffer overflow vulnerability to terminate the Web server, gaining privileged permission in the process.

Where can I find more information about CVE-2021-28187?

More information about CVE-2021-28187 can be found on the official ASUS product security advisory page, the ASUS support page, and the Taiwan Computer Emergency Response Team (TW-CERT) website.