CVE-2021-28182: ASUS BMC's firmware: buffer overflow - Web Service configuration function

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-06 · updated 2026-06-17
Weakness: CWE-120

Description

The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected products

ASUS Asmb8-Ikvm Firmware: 1.14.51
ASUS Z10Pe-D16 Ws Firmware: 1.14.2
ASUS Z10Pr-D16 Firmware: 1.14.51

References

https://www.asus.com/content/ASUS-Product-Security-Advisory/
https://www.asus.com/tw/support/callus/
https://www.twcert.org.tw/tw/cp-132-4552-5b2c4-1.html
https://www.asus.com/content/ASUS-Product-Security-Advisory/
https://www.asus.com/tw/support/callus/
https://www.twcert.org.tw/tw/cp-132-4552-5b2c4-1.html

Get alerted when CVE-2021-28182 or the next vulnerability affects your stack