medium4.9
CVE-2021-28197
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffe…
Impact
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Asus | Asmb9-Ikvm Firmware | Version 1.11.12 |
| Asus | Rs720a-E9-Rs24-E Firmware | Version 1.10.3 |
| Asus | Rs700a-E9-Rs4 Firmware | Version 1.10.0 |
| Asus | Rs700-E9-Rs4 Firmware | Version 1.09 |
| Asus | Esc4000 G4x Firmware | Version 1.11.6 |
| Asus | Rs700-E9-Rs12 Firmware | Version 1.11.5 |
| Asus | Rs100-E10-Pi2 Firmware | Version 1.13.6 |
| Asus | Rs300-E10-Ps4 Firmware | Version 1.13.6 |
| Asus | Rs300-E10-Rs4 Firmware | Version 1.13.6 |
| Asus | Rs500a-E9-Ps4 Firmware | Version 1.14.1 |
| Asus | Rs500a-E9-Rs4 Firmware | Version 1.14.1 |
| Asus | Rs500a-E9 Rs4 U Firmware | Version 1.14.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- https://www.asus.com/tw/support/callus/
- https://www.twcert.org.tw/tw/cp-132-4567-34350-1.html
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- https://www.asus.com/tw/support/callus/
- https://www.twcert.org.tw/tw/cp-132-4567-34350-1.html