CVE-2021-28202 ASUS BMC's firmware: buffer overflow - Service configuration-2 function

Medium 4.9 Published 6 Apr 2021 Updated 17 Sep 2024

Remote attackers can cause a buffer overflow in ASUS BMC firmware, leading to abnormal termination of the web service and denial of service.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-28202?

CVE-2021-28202 is a medium-severity memory corruption vulnerability in ASUS BMC firmware for ASMB9-iKVM, published on 6 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Weakness: CWE-120

Which versions are affected by CVE-2021-28202?

It affects 44 products.

Products include Asus Asmb9-Ikvm Firmware, Asus E700 G4 Firmware, Asus Esc4000 Dhd G4 Firmware, Asus Esc4000 G4 Firmware, Asus Esc4000 G4x Firmware, Asus Esc8000 G4\/10g Firmware and 38 more.

How do I fix CVE-2021-28202?

No fix has been published for CVE-2021-28202 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-28202 being exploited?

There is no known exploitation of CVE-2021-28202 in the wild and no public exploit code.

Sources

Also known as GHSA-93gh-j29f-4h3w.