Buffer overflow

The specific function in ASUS BMC’s firmware Web management page Generate new certificate function does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the...

Buffer overflow

The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web servic...

Command injection

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...

Buffer overflow

The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28208

Summary: CVE-2021-28208 concerns ASUS BMC firmware. The issue arises in the firmware Web management page, specifically the Get video file function, where input is not properly filtered, enabling path traversal. What’s affected: ASUS BMC firmware Web management page (Get video file function). Root...

CVE-2021-28209

The CVE-2021-28209 issue affects ASUS BMC firmware Web management (Delete video file function). A parameter is not properly filtered, enabling path traversal to access system files. According to multiple sources, remote attackers with administrator privileges can exploit this to read restricted f...

CVE-2021-28207 ASUS BMC's firmware: path traversal - Get Help file function

The specific function in ASUS BMC’s firmware Web management page Get Help file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28207

The CVE describes a path traversal vulnerability in ASUS BMC firmware: the Web management page Get Help file function does not validate a parameter, allowing a remote attacker with administrator permissions to access system files. This is due to insufficient input filtering on the affected functi...

CVE-2021-28204

The CVE concerns ASUS BMC firmware: the Web management page’s Modify user’s information function does not filter a specific parameter, enabling remote command injection when an administrator token is compromised. Affected: ASUS BMC firmware Web Management page; Vulnerable component: Modify user’s...

CVE-2021-28202

The CVE-2021-28202 case concerns ASUS BMC firmware’s Web management page, where the Service configuration-2 function does not validate user-entered string length, causing a buffer overflow. The underlying flaw is improper input length handling in the Web interface, leading to a vulnerability that...

CVE-2021-28203 ASUS BMC's firmware: command injection - Web Set Media Image function

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...

CVE-2021-28202 ASUS BMC's firmware: buffer overflow - Service configuration-2 function

The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28203

CVE-2021-28203 concerns ASUS BMC firmware where the Web management page’s Web Set Media Image function does not filter a specific parameter. This leads to a remote command-injection vulnerability that requires administrator privileges to exploit, enabling arbitrary command execution. Connected so...

CVE-2021-28201 ASUS BMC's firmware: buffer overflow - Service configuration-1 function

The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28201

ASUS BMC firmware Web management page vulnerability where the Service configuration-1 function does not validate the length of user input, causing a buffer overflow. Remote attackers could terminate the Web service. CVSS‑3.1 base score 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Exploitation statu...

CVE-2021-28200 ASUS BMC's firmware: buffer overflow - CD media configuration function

The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28199

CVE-2021-28199 affects ASUS BMC firmware: the Web management page’s “Modify user’s information” function does not verify the length of user-entered strings, causing a buffer overflow. This could allow a remote attacker with privileges to terminate the Web service (as indicated by CVSS/impact data...

CVE-2021-28198 ASUS BMC's firmware: buffer overflow - Firmware protocol configuration

The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web servic...

CVE-2021-28197

CVE-2021-28197 concerns ASUS BMC firmware: the Active Directory configuration function on the Web management page does not verify the string length, causing a buffer overflow in the web interface. The vulnerability arises from improper input length validation in the AD configuration, enabling rem...

CVE-2021-28196

The CVE-2021-28196 issue affects ASUS BMC firmware Web management (Generate SSL certificate function). The root cause is failure to validate user-entered string length, leading to a buffer overflow. This could allow remote attackers with privileged access to terminate the Web service via leakage ...