medium4.9
CVE-2021-28189
The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow v…
Impact
The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Asus | Z10pr-D16 Firmware | Version 1.14.51 |
| Asus | Asmb8-Ikvm Firmware | Version 1.14.51 |
| Asus | Z10pe-D16 Ws Firmware | Version 1.14.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- https://www.asus.com/tw/support/callus/
- https://www.twcert.org.tw/tw/cp-132-4559-ad2b5-1.html
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- https://www.asus.com/tw/support/callus/
- https://www.twcert.org.tw/tw/cp-132-4559-ad2b5-1.html