CVE Feed

    Dashboard / CVE / CVE-2021-28191

    CVE-2021-28191

    The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

    Published:Apr 6, 2021
    Last Modified:Nov 21, 2024
    EPS:Apr 6, 2021
    EPSS Score:0.00895
    CVSS Score:4.9

    Affected Products

    Vendor
    Asus
    Product
    Asmb9-ikvm
    Vendor
    Asus
    Product
    Asmb9-ikvm Firmware
    Vendor
    Asus
    Product
    E700 G4
    Vendor
    Asus
    Product
    E700 G4 Firmware
    Vendor
    Asus
    Product
    Esc4000 Dhd G4
    Vendor
    Asus
    Product
    Esc4000 Dhd G4 Firmware
    Vendor
    Asus
    Product
    Esc4000 G4
    Vendor
    Asus
    Product
    Esc4000 G4 Firmware
    Vendor
    Asus
    Product
    Esc4000 G4x
    Vendor
    Asus
    Product
    Esc4000 G4x Firmware
    Vendor
    Asus
    Product
    Esc8000 G4
    Vendor
    Asus
    Product
    Esc8000 G4\/10g
    Vendor
    Asus
    Product
    Esc8000 G4\/10g Firmware
    Vendor
    Asus
    Product
    Esc8000 G4 Firmware
    Vendor
    Asus
    Product
    Knpa-u16
    Vendor
    Asus
    Product
    Knpa-u16 Firmware
    Vendor
    Asus
    Product
    Pro E800 G4
    Vendor
    Asus
    Product
    Pro E800 G4 Firmware
    Vendor
    Asus
    Product
    Rs100-e10-pi2
    Vendor
    Asus
    Product
    Rs100-e10-pi2 Firmware
    Vendor
    Asus
    Product
    Rs300-e10-ps4
    Vendor
    Asus
    Product
    Rs300-e10-ps4 Firmware
    Vendor
    Asus
    Product
    Rs300-e10-rs4
    Vendor
    Asus
    Product
    Rs300-e10-rs4 Firmware
    Vendor
    Asus
    Product
    Rs500-e9-ps4
    Vendor
    Asus
    Product
    Rs500-e9-ps4 Firmware
    Vendor
    Asus
    Product
    Rs500-e9-rs4
    Vendor
    Asus
    Product
    Rs500-e9-rs4-u
    Vendor
    Asus
    Product
    Rs500-e9-rs4-u Firmware
    Vendor
    Asus
    Product
    Rs500-e9-rs4 Firmware
    Vendor
    Asus
    Product
    Rs500a-e10-ps4
    Vendor
    Asus
    Product
    Rs500a-e10-ps4 Firmware
    Vendor
    Asus
    Product
    Rs500a-e10-rs4
    Vendor
    Asus
    Product
    Rs500a-e10-rs4 Firmware
    Vendor
    Asus
    Product
    Rs500a-e9-ps4
    Vendor
    Asus
    Product
    Rs500a-e9-ps4 Firmware
    Vendor
    Asus
    Product
    Rs500a-e9-rs4
    Vendor
    Asus
    Product
    Rs500a-e9-rs4 Firmware
    Vendor
    Asus
    Product
    Rs500a-e9 Rs4 U
    Vendor
    Asus
    Product
    Rs500a-e9 Rs4 U Firmware
    Vendor
    Asus
    Product
    Rs520-e9-rs12-e
    Vendor
    Asus
    Product
    Rs520-e9-rs12-e Firmware
    Vendor
    Asus
    Product
    Rs520-e9-rs8
    Vendor
    Asus
    Product
    Rs520-e9-rs8 Firmware
    Vendor
    Asus
    Product
    Rs700-e9-rs12
    Vendor
    Asus
    Product
    Rs700-e9-rs12 Firmware
    Vendor
    Asus
    Product
    Rs700-e9-rs4
    Vendor
    Asus
    Product
    Rs700-e9-rs4 Firmware
    Vendor
    Asus
    Product
    Rs700a-e9-rs12v2
    Vendor
    Asus
    Product
    Rs700a-e9-rs12v2 Firmware
    Vendor
    Asus
    Product
    Rs700a-e9-rs4
    Vendor
    Asus
    Product
    Rs700a-e9-rs4 Firmware
    Vendor
    Asus
    Product
    Rs700a-e9-rs4v2
    Vendor
    Asus
    Product
    Rs700a-e9-rs4v2 Firmware
    Vendor
    Asus
    Product
    Rs720-e9-rs12-e
    Vendor
    Asus
    Product
    Rs720-e9-rs12-e Firmware
    Vendor
    Asus
    Product
    Rs720-e9-rs24-u
    Vendor
    Asus
    Product
    Rs720-e9-rs24-u Firmware
    Vendor
    Asus
    Product
    Rs720-e9-rs8-g
    Vendor
    Asus
    Product
    Rs720-e9-rs8-g Firmware
    Vendor
    Asus
    Product
    Rs720a-e9-rs12v2
    Vendor
    Asus
    Product
    Rs720a-e9-rs12v2 Firmware
    Vendor
    Asus
    Product
    Rs720a-e9-rs24-e
    Vendor
    Asus
    Product
    Rs720a-e9-rs24-e Firmware
    Vendor
    Asus
    Product
    Rs720a-e9-rs24v2
    Vendor
    Asus
    Product
    Rs720a-e9-rs24v2 Firmware
    Vendor
    Asus
    Product
    Rs720q-e9-rs24-s
    Vendor
    Asus
    Product
    Rs720q-e9-rs24-s Firmware
    Vendor
    Asus
    Product
    Rs720q-e9-rs8
    Vendor
    Asus
    Product
    Rs720q-e9-rs8-s
    Vendor
    Asus
    Product
    Rs720q-e9-rs8-s Firmware
    Vendor
    Asus
    Product
    Rs720q-e9-rs8 Firmware
    Vendor
    Asus
    Product
    Ws C422 Pro\/se
    Vendor
    Asus
    Product
    Ws C422 Pro\/se Firmware
    Vendor
    Asus
    Product
    Ws C621e Sage
    Vendor
    Asus
    Product
    Ws C621e Sage Firmware
    Vendor
    Asus
    Product
    Ws X299 Pro\/se
    Vendor
    Asus
    Product
    Ws X299 Pro\/se Firmware
    Vendor
    Asus
    Product
    Z11pa-d8
    Vendor
    Asus
    Product
    Z11pa-d8 Firmware
    Vendor
    Asus
    Product
    Z11pa-d8c
    Vendor
    Asus
    Product
    Z11pa-d8c Firmware
    Vendor
    Asus
    Product
    Z11pa-u12
    Vendor
    Asus
    Product
    Z11pa-u12\/10g-2s
    Vendor
    Asus
    Product
    Z11pa-u12\/10g-2s Firmware
    Vendor
    Asus
    Product
    Z11pa-u12 Firmware
    Vendor
    Asus
    Product
    Z11pr-d16
    Vendor
    Asus
    Product
    Z11pr-d16 Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2021-28209 (CVSS 4.9) — The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter …
    CVE-2021-28208 (CVSS 4.9) — The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the…
    CVE-2021-28207 (CVSS 4.9) — The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the …
    CVE-2021-28206 (CVSS 4.9) — The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter …
    CVE-2021-28202 (CVSS 4.9) — The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string len…
    CVE-2021-28201 (CVSS 4.9) — The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string len…
    CVE-2021-28200 (CVSS 4.9) — The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string leng…
    CVE-2021-28199 (CVSS 4.9) — The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not…
    CVE-2021-28198 (CVSS 4.9) — The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the st…
    CVE-2021-28197 (CVSS 4.9) — The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the str…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High