CVE-2021-28206 ASUS BMC's firmware: path traversal - Record video file function

The specific function in ASUS BMC’s firmware Web management page Record video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28205

The CVE-2021-28205 issue affects ASUS BMC firmware Web management (Delete SOL video file function). The vulnerability arises because the function does not filter a specific parameter, enabling path traversal when an administrator-authenticated session is established, allowing remote access to sys...

CVE-2021-28205 ASUS BMC's firmware: path traversal - Delete SOL video file function

The specific function in ASUS BMC’s firmware Web management page Delete SOL video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28204 ASUS BMC's firmware: command injection - Modify user’s information function

The specific function in ASUS BMC’s firmware Web management page Modify user’s information function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...

CVE-2021-28204

The CVE concerns ASUS BMC firmware: the Web management page’s Modify user’s information function does not filter a specific parameter, enabling remote command injection when an administrator token is compromised. Affected: ASUS BMC firmware Web Management page; Vulnerable component: Modify user’s...

CVE-2021-28203 ASUS BMC's firmware: command injection - Web Set Media Image function

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...

CVE-2021-28202

The CVE-2021-28202 case concerns ASUS BMC firmware’s Web management page, where the Service configuration-2 function does not validate user-entered string length, causing a buffer overflow. The underlying flaw is improper input length handling in the Web interface, leading to a vulnerability that...

CVE-2021-28202 ASUS BMC's firmware: buffer overflow - Service configuration-2 function

The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28203

CVE-2021-28203 concerns ASUS BMC firmware where the Web management page’s Web Set Media Image function does not filter a specific parameter. This leads to a remote command-injection vulnerability that requires administrator privileges to exploit, enabling arbitrary command execution. Connected so...

CVE-2021-28201 ASUS BMC's firmware: buffer overflow - Service configuration-1 function

The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28201

ASUS BMC firmware Web management page vulnerability where the Service configuration-1 function does not validate the length of user input, causing a buffer overflow. Remote attackers could terminate the Web service. CVSS‑3.1 base score 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Exploitation statu...

CVE-2021-28200

The CVE-2021-28200 entry concerns ASUS BMC firmware Web management page where the CD media configuration function does not validate the length of user-entered strings, causing a buffer overflow. The root cause is improper input length validation in the CD media configuration flow, which can lead ...

CVE-2021-28200 ASUS BMC's firmware: buffer overflow - CD media configuration function

The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28199

CVE-2021-28199 affects ASUS BMC firmware: the Web management page’s “Modify user’s information” function does not verify the length of user-entered strings, causing a buffer overflow. This could allow a remote attacker with privileges to terminate the Web service (as indicated by CVSS/impact data...

CVE-2021-28199 ASUS BMC's firmware: buffer overflow - Modify user’s information function

The specific function in ASUS BMC’s firmware Web management page Modify user’s information function does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate th...

CVE-2021-28198 ASUS BMC's firmware: buffer overflow - Firmware protocol configuration

The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web servic...

CVE-2021-28197

CVE-2021-28197 concerns ASUS BMC firmware: the Active Directory configuration function on the Web management page does not verify the string length, causing a buffer overflow in the web interface. The vulnerability arises from improper input length validation in the AD configuration, enabling rem...

CVE-2021-28198

The CVE-2021-28198 entry describes a buffer overflow in ASUS BMC’s firmware Web management page caused by the Firmware protocol configuration function not validating user-entered string length. This can allow remote attackers (with privileged access) to terminate the Web service; exploitation det...

CVE-2021-28197 ASUS BMC's firmware: buffer overflow - Active Directory configuration function

The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28196

The CVE-2021-28196 issue affects ASUS BMC firmware Web management (Generate SSL certificate function). The root cause is failure to validate user-entered string length, leading to a buffer overflow. This could allow remote attackers with privileged access to terminate the Web service via leakage ...