VulnerabilityModified
CVE-2021-28180
The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability.
MEDIUM 4.9EPSS 1.81%
Does this matter?
Lower severity and a low EPSS score (1.81%). Track it; it rarely justifies an emergency change on its own.
Description
The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.81% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- asus/z10pr-d16 firmware · asus/asmb8-ikvm firmware · asus/z10pe-d16 ws firmware
- Source
- twcert@cert.org.tw
References
- https://www.asus.com/content/ASUS-Product-Security-Advisory/Vendor Advisory
- https://www.asus.com/tw/support/callus/Vendor Advisory
- https://www.twcert.org.tw/tw/cp-132-4550-5ee8c-1.htmlThird Party Advisory
- https://www.asus.com/content/ASUS-Product-Security-Advisory/Vendor Advisory
- https://www.asus.com/tw/support/callus/Vendor Advisory
- https://www.twcert.org.tw/tw/cp-132-4550-5ee8c-1.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.