VulnerabilityModified
CVE-2021-28176
The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability.
MEDIUM 4.9EPSS 1.86%
Does this matter?
Lower severity and a low EPSS score (1.86%). Track it; it rarely justifies an emergency change on its own.
Description
The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.86% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- asus/z10pr-d16 firmware · asus/asmb8-ikvm firmware · asus/z10pe-d16 ws firmware
- Source
- twcert@cert.org.tw
References
- https://www.asus.com/content/ASUS-Product-Security-Advisory/Vendor Advisory
- https://www.asus.com/tw/support/callus/Vendor Advisory
- https://www.twcert.org.tw/tw/cp-132-4544-0a409-1.htmlThird Party Advisory
- https://www.asus.com/content/ASUS-Product-Security-Advisory/Vendor Advisory
- https://www.asus.com/tw/support/callus/Vendor Advisory
- https://www.twcert.org.tw/tw/cp-132-4544-0a409-1.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.