CVE-2021-28188: ASUS BMC's firmware: buffer overflow - Modify user’s information function

Published Apr 6, 2021

Updated

The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected Software

6 affected components

ASUS Z10pr-d16 Firmware=1.14.51

ASUS Z10pr-d16

ASUS Asmb8-ikvm Firmware=1.14.51

ASUS Asmb8-ikvm

ASUS Z10pe-d16 Ws Firmware=1.14.2

ASUS Z10pe-d16 Ws

Remediation

Information

update BMC's firmwares to the following versions: Z10PR-D16 1.16.1 ASMB8-iKVM 1.16.1 Z10PE-D16 WS 1.16.1

Event History

Apr 6, 2021

CVE Published

via MITRE·05:02 AM

Data Sourced

via MITRE·05:02 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-28188?

CVE-2021-28188 is a Buffer overflow vulnerability in the Modify user's information function of ASUS BMC's firmware Web management page.

What is the severity of CVE-2021-28188?

CVE-2021-28188 has a severity rating of 4.9, which is considered medium.

Which software is affected by CVE-2021-28188?

Asus Z10pr-d16 Firmware version 1.14.51 and Asus Asmb8-ikvm Firmware version 1.14.51 are affected by CVE-2021-28188.

How can remote attackers exploit CVE-2021-28188?

Remote attackers can exploit CVE-2021-28188 by using the leakage to abnormally terminate the system and obtain privileged permission.

Where can I find more information about CVE-2021-28188?

You can find more information about CVE-2021-28188 on the ASUS Product Security Advisory, ASUS Support, and TW-CERT websites.