Riskcovery

CVE-2021-28201

ASUS BMC's firmware: buffer overflow - Service configuration-1 function

State
Published
Severity
4.9 Medium
Published
Apr 6, 2021
Updated
Sep 17, 2024
Reserved
Mar 12, 2021

Read the record on cve.org

Description

The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Scores

CVSSScoreVectorSource
3.14.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:Htwcert

Weaknesses

Affected Products

ProductVersions
BMC firmware for ASMB9-iKVMASUS
  • 1.11.12Affected
BMC firmware for RS720A-E9-RS24-EASUS
  • 1.10.3Affected
BMC firmware for RS700A-E9-RS4ASUS
  • 1.10.0Affected
BMC firmware for RS700-E9-RS4ASUS
  • 1.09Affected
BMC firmware for ESC4000 G4XASUS
  • 1.11.6Affected
BMC firmware for RS700-E9-RS12ASUS
  • 1.11.5Affected
BMC firmware for RS100-E10-PI2ASUS
  • 1.13.6Affected
BMC firmware for RS300-E10-PS4ASUS
  • 1.13.6Affected
BMC firmware for RS300-E10-RS4ASUS
  • 1.13.6Affected
BMC firmware for RS500A-E9-PS4ASUS
  • 1.14.1Affected
BMC firmware for RS500A-E9-RS4ASUS
  • 1.14.1Affected
BMC firmware for RS500A-E9 RS4ASUS
  • 1.14.1Affected
BMC firmware for E700 G4ASUS
  • 1.14.1Affected
BMC firmware for WS C422 PRO/SEASUS
  • 1.14.1Affected
BMC firmware for WS X299 PRO/SEASUS
  • 1.14.1Affected
BMC firmware for Z11PA-U12ASUS
  • 1.15.1Affected
BMC firmware for Z11PA-U12/10G-2SASUS
  • 1.15.1Affected
BMC firmware for KNPA-U16ASUS
  • 1.13.4Affected
BMC firmware for ESC4000 DHD G4ASUS
  • 1.13.7Affected
BMC firmware for ESC4000 G4ASUS
  • 1.15.2Affected
BMC firmware for RS720Q-E9-RS24-SASUS
  • 1.15.0Affected
BMC firmware for RS720Q-E9-RS8ASUS
  • 1.15.0Affected
BMC firmware for RS720Q-E9-RS8-SASUS
  • 1.15.0Affected
BMC firmware for Z11PA-D8ASUS
  • 1.14.1Affected
BMC firmware for Z11PA-D8CASUS
  • 1.14.1Affected
BMC firmware for RS720-E9-RS24-UASUS
  • 1.14.3Affected
BMC firmware for RS720-E9-RS8-GASUS
  • 1.15.2Affected
BMC firmware for RS500-E9-PS4ASUS
  • 1.15.4Affected
BMC firmware for Pro E800 G4ASUS
  • 1.14.2Affected
BMC firmware for RS500-E9-RS4ASUS
  • 1.15.4Affected
BMC firmware for RS500-E9-RS4-UASUS
  • 1.15.4Affected
BMC firmware for RS520-E9-RS12-EASUS
  • 1.15.3Affected
BMC firmware for RS520-E9-RS8ASUS
  • 1.15.3Affected
BMC firmware for ESC8000 G4ASUS
  • 1.15.4Affected
BMC firmware for ESC8000 G4/10GASUS
  • 1.15.4Affected
BMC firmware for RS720-E9-RS12-EASUS
  • 1.15.2Affected
BMC firmware for WS C621E SAGEASUS
  • 1.15.1Affected
BMC firmware for RS500A-E10-PS4ASUS
  • 1.15.2Affected
BMC firmware for RS500A-E10-RS4ASUS
  • 1.15.2Affected
BMC firmware for RS700A-E9-RS12V2ASUS
  • 1.15.1Affected
BMC firmware for RS700A-E9-RS4V2ASUS
  • 1.15.1Affected
BMC firmware for RS720A-E9-RS12V2ASUS
  • 1.15.2Affected
BMC firmware for RS720A-E9-RS24V2ASUS
  • 1.15.1Affected
BMC firmware for Z11PR-D16ASUS
  • 1.15.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.