Strix
26.1K

CVE-2021-28202

MEDIUMCVSS 4.9/10EPSS 1.81%

Last modified

CVE-2021-28202 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.. EPSS estimates a 1.81% chance of exploitation in the next 30 days.

Description

The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Metrics

CVSS 3.1
4.9/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
1.81%

75.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
AsusAsmb9-Ikvm Firmware1.11.12
AsusRs720a-E9-Rs24-E Firmware1.10.3
AsusRs700a-E9-Rs4 Firmware1.10.0
AsusRs700-E9-Rs4 Firmware1.09
AsusEsc4000 G4x Firmware1.11.6
AsusRs700-E9-Rs12 Firmware1.11.5
AsusRs100-E10-Pi2 Firmware1.13.6
AsusRs300-E10-Ps4 Firmware1.13.6
AsusRs300-E10-Rs4 Firmware1.13.6
AsusRs500a-E9-Ps4 Firmware1.14.1
AsusRs500a-E9-Rs4 Firmware1.14.1
AsusRs500a-E9 Rs4 U Firmware1.14.1
AsusE700 G4 Firmware1.14.1
AsusWs C422 Pro\/Se Firmware1.14.1
AsusWs X299 Pro\/Se Firmware1.14.1
AsusZ11pa-U12 Firmware1.15.1
AsusZ11pa-U12\/10g-2s Firmware1.15.1
AsusKnpa-U16 Firmware1.13.4
AsusEsc4000 Dhd G4 Firmware1.13.7
AsusEsc4000 G4 Firmware1.15.2
AsusRs720q-E9-Rs24-S Firmware1.15.0
AsusRs720q-E9-Rs8 Firmware1.15.0
AsusRs720q-E9-Rs8-S Firmware1.15.0
AsusZ11pa-D8 Firmware1.14.1
AsusZ11pa-D8c Firmware1.14.1
AsusRs720-E9-Rs24-U Firmware1.14.3
AsusRs720-E9-Rs8-G Firmware1.15.2
AsusRs500-E9-Ps4 Firmware1.15.4
AsusPro E800 G4 Firmware1.14.2
AsusRs500-E9-Rs4 Firmware1.15.4
AsusRs500-E9-Rs4-U Firmware1.15.4
AsusRs520-E9-Rs12-E Firmware1.15.3
AsusRs520-E9-Rs8 Firmware1.15.3
AsusEsc8000 G4 Firmware1.15.4
AsusEsc8000 G4\/10g Firmware1.15.4
AsusRs720-E9-Rs12-E Firmware1.15.2
AsusWs C621e Sage Firmware1.15.1
AsusRs500a-E10-Ps4 Firmware1.15.2
AsusRs500a-E10-Rs4 Firmware1.15.2
AsusRs700a-E9-Rs12v2 Firmware1.15.1
AsusRs700a-E9-Rs4v2 Firmware1.15.1
AsusRs720a-E9-Rs12v2 Firmware1.15.2
AsusRs720a-E9-Rs24v2 Firmware1.15.1
AsusZ11pr-D16 Firmware1.15.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-28202?
The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
How severe is CVE-2021-28202?
CVE-2021-28202 has a CVSS score of 4.9/10 (MEDIUM severity). The EPSS model estimates a 1.81% probability of exploitation in the next 30 days.
How do I fix CVE-2021-28202?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-28202?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST