What’s Vulnerable › Vulnerabilities

CVE-2021-28186: ASUS BMC's firmware: buffer overflow - ActiveX configuration-2 acquisition

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-06 · updated 2026-06-17
• Weakness: CWE-120

Description

The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected products

• ASUS Asmb8-Ikvm Firmware: 1.14.51
• ASUS Z10Pe-D16 Ws Firmware: 1.14.2
• ASUS Z10Pr-D16 Firmware: 1.14.51

References

• https://www.asus.com/content/ASUS-Product-Security-Advisory/
• https://www.asus.com/tw/support/callus/
• https://www.twcert.org.tw/tw/cp-132-4556-ece3d-1.html
• https://www.asus.com/content/ASUS-Product-Security-Advisory/
• https://www.asus.com/tw/support/callus/
• https://www.twcert.org.tw/tw/cp-132-4556-ece3d-1.html

Get alerted when CVE-2021-28186 or the next vulnerability affects your stack