CVE-2021-28181

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-281824.9The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, result CVE-2021-281834.9The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length enter CVE-2021-281844.9The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, r CVE-2021-281854.9The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length ent CVE-2021-281864.9The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length ent CVE-2021-281874.9The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by CVE-2021-281884.9The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length ente CVE-2021-281894.9The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in CVE-2021-281904.9The specific function in ASUS BMC’s firmware Web management page (Generate new certificate function) does not verify the string length enter CVE-2021-281914.9The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a B CVE-2021-281924.9The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered b CVE-2021-281934.9The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in