What’s Vulnerable › Vulnerabilities
CVE-2021-28191: ASUS BMC's firmware: buffer overflow - Firmware update function
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-04-06 · updated 2026-06-17
- Weakness: CWE-120
Description
The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Affected products
- ASUS Asmb9-Ikvm Firmware: 1.11.12
- ASUS E700 G4 Firmware: 1.14.1
- ASUS Esc4000 Dhd G4 Firmware: 1.13.7
- ASUS Esc4000 G4 Firmware: 1.15.2
- ASUS Esc4000 G4X Firmware: 1.11.6
- ASUS Esc8000 G4/10G Firmware: 1.15.4
- ASUS Esc8000 G4 Firmware: 1.15.4
- ASUS Knpa-U16 Firmware: 1.13.4
- ASUS Pro E800 G4 Firmware: 1.14.2
- ASUS Rs100-E10-Pi2 Firmware: 1.13.6
- ASUS Rs300-E10-Ps4 Firmware: 1.13.6
- ASUS Rs300-E10-Rs4 Firmware: 1.13.6
- ASUS Rs500-E9-Ps4 Firmware: 1.15.4
- ASUS Rs500-E9-Rs4-U Firmware: 1.15.4
- ASUS Rs500-E9-Rs4 Firmware: 1.15.4
- ASUS Rs500A-E10-Ps4 Firmware: 1.15.2
- ASUS Rs500A-E10-Rs4 Firmware: 1.15.2
- ASUS Rs500A-E9-Ps4 Firmware: 1.14.1
- ASUS Rs500A-E9-Rs4 Firmware: 1.14.1
- ASUS Rs500A-E9 Rs4 U Firmware: 1.14.1
- ASUS Rs520-E9-Rs12-E Firmware: 1.15.3
- ASUS Rs520-E9-Rs8 Firmware: 1.15.3
- ASUS Rs700-E9-Rs12 Firmware: 1.11.5
- ASUS Rs700-E9-Rs4 Firmware: 1.09
- ASUS Rs700A-E9-Rs12V2 Firmware: 1.15.1
- ASUS Rs700A-E9-Rs4 Firmware: 1.10.0
- ASUS Rs700A-E9-Rs4V2 Firmware: 1.15.1
- ASUS Rs720-E9-Rs12-E Firmware: 1.15.2
- ASUS Rs720-E9-Rs24-U Firmware: 1.14.3
- ASUS Rs720-E9-Rs8-G Firmware: 1.15.2
References
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- https://www.asus.com/tw/support/callus/
- https://www.twcert.org.tw/tw/cp-132-4561-062d0-1.html
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- https://www.asus.com/tw/support/callus/
- https://www.twcert.org.tw/tw/cp-132-4561-062d0-1.html
Get alerted when CVE-2021-28191 or the next vulnerability affects your stack