CVE-2021-28176: medium-severity vulnerability in ASUS BMC firmware for ASMB8-iKVM
ASUS BMC's firmware: buffer overflow - DNS configuration function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.9epss 1.9%
The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
ASUS · BMC firmware for ASMB8-iKVMASUS · BMC firmware for Z10PE-D16 WSASUS · BMC firmware for Z10PR-D16Related CVEs — ASUS BMC firmware for ASMB8-iKVM
In the same product, most dangerous first.
CVE-2021-28204HIGHASUS BMC's firmware: command injection - Modify user’s information functionEPSS 2.1%CVE-2021-28203HIGHASUS BMC's firmware: command injection - Web Set Media Image functionEPSS 2.0%CVE-2021-28205MEDIUMASUS BMC's firmware: path traversal - Delete SOL video file functionEPSS 2.0%CVE-2021-28175MEDIUMASUS BMC's firmware: buffer overflow - Radius configuration functionEPSS 1.9%CVE-2021-28189MEDIUMASUS BMC's firmware: buffer overflow - SMTP configuration functionEPSS 1.9%CVE-2021-28188MEDIUMASUS BMC's firmware: buffer overflow - Modify user’s information functionEPSS 1.9%