CVE-2021-28200mediumCWE-120

CVE-2021-28200: medium-severity vulnerability in ASUS BMC firmware for ASMB9-iKVM

ASUS BMC's firmware: buffer overflow - CD media configuration function

Published 06 Apr 2021 · Updated 16 Sep 2024

Follow this CVE + Monitor BMC firmware for ASMB9-iKVM + Monitor BMC firmware for E700 G4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 1.9%

The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Related CVEs — ASUS BMC firmware for ASMB9-iKVM

In the same product, most dangerous first.

CVE-2021-28209MEDIUMASUS BMC's firmware: path traversal - Delete video file functionEPSS 2.0%CVE-2021-28208MEDIUMASUS BMC's firmware: path traversal - Get video file functionEPSS 2.0%CVE-2021-28207MEDIUMASUS BMC's firmware: path traversal - Get Help file functionEPSS 2.0%CVE-2021-28206MEDIUMASUS BMC's firmware: path traversal - Record video file functionEPSS 2.0%CVE-2021-28202MEDIUMASUS BMC's firmware: buffer overflow - Service configuration-2 functionEPSS 1.9%CVE-2021-28201MEDIUMASUS BMC's firmware: buffer overflow - Service configuration-1 functionEPSS 1.9%

References

https://www.asus.com/content/ASUS-Product-Security-Advisory/https://www.asus.com/tw/support/callus/https://www.twcert.org.tw/tw/cp-132-4570-4d216-1.html