CVE-2021-28187

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-281884.9The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length enteCVE-2021-281894.9The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in CVE-2021-281904.9The specific function in ASUS BMC’s firmware Web management page (Generate new certificate function) does not verify the string length enterCVE-2021-281914.9The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a BCVE-2021-281924.9The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered bCVE-2021-281934.9The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in CVE-2021-281944.9The specific function in ASUS BMC’s firmware Web management page (Remote image configuration setting) does not verify the string length enteCVE-2021-281954.9The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting iCVE-2021-281964.9The specific function in ASUS BMC’s firmware Web management page (Generate SSL certificate function) does not verify the string length enterCVE-2021-281974.9The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, rCVE-2021-281984.9The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, CVE-2021-281994.9The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length ente
CVE-2021-28187: Medium severity, CVSS 4.9 | Vulnix