CVE-2021-28201

Published: Apr 6, 2021Modified: Nov 21, 2024

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected (44)

Products: Asus: Asmb9 Ikvm Firmware, Rs720a E9 Rs24 E Firmware, Rs700a E9 Rs4 Firmware, Rs700 E9 Rs4 Firmware, Esc4000 G4x Firmware, Rs700 E9 Rs12 Firmware, Rs100 E10 Pi2 Firmware, Rs300 E10 Ps4 Firmware, Rs300 E10 Rs4 Firmware, Rs500a E9 Ps4 Firmware, Rs500a E9 Rs4 Firmware, Rs500a E9 Rs4 U Firmware, E700 G4 Firmware, Ws C422 Pro/se Firmware, Ws X299 Pro/se Firmware, Z11pa U12 Firmware, Z11pa U12/10g 2s Firmware, Knpa U16 Firmware, Esc4000 Dhd G4 Firmware, Esc4000 G4 Firmware, Rs720q E9 Rs24 S Firmware, Rs720q E9 Rs8 Firmware, Rs720q E9 Rs8 S Firmware, Z11pa D8 Firmware, Z11pa D8c Firmware, Rs720 E9 Rs24 U Firmware, Rs720 E9 Rs8 G Firmware, Rs500 E9 Ps4 Firmware, Pro E800 G4 Firmware, Rs500 E9 Rs4 Firmware, Rs500 E9 Rs4 U Firmware, Rs520 E9 Rs12 E Firmware, Rs520 E9 Rs8 Firmware, Esc8000 G4 Firmware, Esc8000 G4/10g Firmware, Rs720 E9 Rs12 E Firmware, Ws C621e Sage Firmware, Rs500a E10 Ps4 Firmware, Rs500a E10 Rs4 Firmware, Rs700a E9 Rs12v2 Firmware, Rs700a E9 Rs4v2 Firmware, Rs720a E9 Rs12v2 Firmware, Rs720a E9 Rs24v2 Firmware, Z11pr D16 Firmware

Asus

44 products

Asmb9 Ikvm Firmware

Rs720a E9 Rs24 E Firmware

Rs700a E9 Rs4 Firmware

Rs700 E9 Rs4 Firmware

Esc4000 G4x Firmware

Rs700 E9 Rs12 Firmware

Rs100 E10 Pi2 Firmware

Rs300 E10 Ps4 Firmware

Rs300 E10 Rs4 Firmware

Rs500a E9 Ps4 Firmware

Rs500a E9 Rs4 Firmware

Rs500a E9 Rs4 U Firmware

E700 G4 Firmware

Ws C422 Pro/se Firmware

Ws X299 Pro/se Firmware

Z11pa U12 Firmware

Z11pa U12/10g 2s Firmware

Knpa U16 Firmware

Esc4000 Dhd G4 Firmware

Esc4000 G4 Firmware

Rs720q E9 Rs24 S Firmware

Rs720q E9 Rs8 Firmware

Rs720q E9 Rs8 S Firmware

Z11pa D8 Firmware

Z11pa D8c Firmware

Rs720 E9 Rs24 U Firmware

Rs720 E9 Rs8 G Firmware

Rs500 E9 Ps4 Firmware

Pro E800 G4 Firmware

Rs500 E9 Rs4 Firmware

Rs500 E9 Rs4 U Firmware

Rs520 E9 Rs12 E Firmware

Rs520 E9 Rs8 Firmware

Esc8000 G4 Firmware

Esc8000 G4/10g Firmware

Rs720 E9 Rs12 E Firmware

Ws C621e Sage Firmware

Rs500a E10 Ps4 Firmware

Rs500a E10 Rs4 Firmware

Rs700a E9 Rs12v2 Firmware

Rs700a E9 Rs4v2 Firmware

Rs720a E9 Rs12v2 Firmware

Rs720a E9 Rs24v2 Firmware

Z11pr D16 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Asmb9 Ikvm Firmware	Version 1.11.12

Running on/with	Platform Versions
Asus Asmb9 Ikvm	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720a E9 Rs24 E Firmware	Version 1.10.3

Running on/with	Platform Versions
Asus Rs720a E9 Rs24 E	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs700a E9 Rs4 Firmware	Version 1.10.0

Running on/with	Platform Versions
Asus Rs700a E9 Rs4	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs700 E9 Rs4 Firmware	Version 1.09

Running on/with	Platform Versions
Asus Rs700 E9 Rs4	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Esc4000 G4x Firmware	Version 1.11.6

Running on/with	Platform Versions
Asus Esc4000 G4x	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs700 E9 Rs12 Firmware	Version 1.11.5

Running on/with	Platform Versions
Asus Rs700 E9 Rs12	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs100 E10 Pi2 Firmware	Version 1.13.6

Running on/with	Platform Versions
Asus Rs100 E10 Pi2	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs300 E10 Ps4 Firmware	Version 1.13.6

Running on/with	Platform Versions
Asus Rs300 E10 Ps4	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs300 E10 Rs4 Firmware	Version 1.13.6

Running on/with	Platform Versions
Asus Rs300 E10 Rs4	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs500a E9 Ps4 Firmware	Version 1.14.1

Running on/with	Platform Versions
Asus Rs500a E9 Ps4	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs500a E9 Rs4 Firmware	Version 1.14.1

Running on/with	Platform Versions
Asus Rs500a E9 Rs4	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs500a E9 Rs4 U Firmware	Version 1.14.1

Running on/with	Platform Versions
Asus Rs500a E9 Rs4 U	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus E700 G4 Firmware	Version 1.14.1

Running on/with	Platform Versions
Asus E700 G4	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Ws C422 Pro/se Firmware	Version 1.14.1

Running on/with	Platform Versions
Asus Ws C422 Pro/se	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Ws X299 Pro/se Firmware	Version 1.14.1

Running on/with	Platform Versions
Asus Ws X299 Pro/se	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Z11pa U12 Firmware	Version 1.15.1

Running on/with	Platform Versions
Asus Z11pa U12	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Z11pa U12/10g 2s Firmware	Version 1.15.1

Running on/with	Platform Versions
Asus Z11pa U12/10g 2s	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Knpa U16 Firmware	Version 1.13.4

Running on/with	Platform Versions
Asus Knpa U16	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Esc4000 Dhd G4 Firmware	Version 1.13.7

Running on/with	Platform Versions
Asus Esc4000 Dhd G4	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Esc4000 G4 Firmware	Version 1.15.2

Running on/with	Platform Versions
Asus Esc4000 G4	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720q E9 Rs24 S Firmware	Version 1.15.0

Running on/with	Platform Versions
Asus Rs720q E9 Rs24 S	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720q E9 Rs8 Firmware	Version 1.15.0

Running on/with	Platform Versions
Asus Rs720q E9 Rs8	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720q E9 Rs8 S Firmware	Version 1.15.0

Running on/with	Platform Versions
Asus Rs720q E9 Rs8 S	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Z11pa D8 Firmware	Version 1.14.1

Running on/with	Platform Versions
Asus Z11pa D8	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Z11pa D8c Firmware	Version 1.14.1

Running on/with	Platform Versions
Asus Z11pa D8c	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720 E9 Rs24 U Firmware	Version 1.14.3

Running on/with	Platform Versions
Asus Rs720 E9 Rs24 U	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720 E9 Rs8 G Firmware	Version 1.15.2

Running on/with	Platform Versions
Asus Rs720 E9 Rs8 G	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs500 E9 Ps4 Firmware	Version 1.15.4

Running on/with	Platform Versions
Asus Rs500 E9 Ps4	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Pro E800 G4 Firmware	Version 1.14.2

Running on/with	Platform Versions
Asus Pro E800 G4	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs500 E9 Rs4 Firmware	Version 1.15.4

Running on/with	Platform Versions
Asus Rs500 E9 Rs4	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs500 E9 Rs4 U Firmware	Version 1.15.4

Running on/with	Platform Versions
Asus Rs500 E9 Rs4 U	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs520 E9 Rs12 E Firmware	Version 1.15.3

Running on/with	Platform Versions
Asus Rs520 E9 Rs12 E	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs520 E9 Rs8 Firmware	Version 1.15.3

Running on/with	Platform Versions
Asus Rs520 E9 Rs8	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Esc8000 G4 Firmware	Version 1.15.4

Running on/with	Platform Versions
Asus Esc8000 G4	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Esc8000 G4/10g Firmware	Version 1.15.4

Running on/with	Platform Versions
Asus Esc8000 G4/10g	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720 E9 Rs12 E Firmware	Version 1.15.2

Running on/with	Platform Versions
Asus Rs720 E9 Rs12 E	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Ws C621e Sage Firmware	Version 1.15.1

Running on/with	Platform Versions
Asus Ws C621e Sage	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs500a E10 Ps4 Firmware	Version 1.15.2

Running on/with	Platform Versions
Asus Rs500a E10 Ps4	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs500a E10 Rs4 Firmware	Version 1.15.2

Running on/with	Platform Versions
Asus Rs500a E10 Rs4	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs700a E9 Rs12v2 Firmware	Version 1.15.1

Running on/with	Platform Versions
Asus Rs700a E9 Rs12v2	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs700a E9 Rs4v2 Firmware	Version 1.15.1

Running on/with	Platform Versions
Asus Rs700a E9 Rs4v2	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720a E9 Rs12v2 Firmware	Version 1.15.2

Running on/with	Platform Versions
Asus Rs720a E9 Rs12v2	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rs720a E9 Rs24v2 Firmware	Version 1.15.1

Running on/with	Platform Versions
Asus Rs720a E9 Rs24v2	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Z11pr D16 Firmware	Version 1.15.3

Running on/with	Platform Versions
Asus Z11pr D16	All versions

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (6)

https://www.asus.com/content/ASUS-Product-Security-Advisory/

Source: twcert@cert.org.tw

Vendor Advisory

https://www.asus.com/tw/support/callus/

Source: twcert@cert.org.tw

Vendor Advisory

https://www.twcert.org.tw/tw/cp-132-4571-d454c-1.html

Source: twcert@cert.org.tw

Third Party Advisory

https://www.asus.com/content/ASUS-Product-Security-Advisory/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.asus.com/tw/support/callus/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.twcert.org.tw/tw/cp-132-4571-d454c-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.