CVE-2021-28199

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-282004.9The CD media configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resultingCVE-2021-282014.9The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resultinCVE-2021-282024.9The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resultinCVE-2021-282037.2The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the adminisCVE-2021-282047.2The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameterCVE-2021-282054.9The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. AsCVE-2021-282064.9The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtCVE-2021-282074.9The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtainiCVE-2021-282084.9The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtainCVE-2021-282094.9The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtCVE-2021-282107.8An unlimited recursion in DxeCore in EDK II.CVE-2021-282116.7A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.
CVE-2021-28199: Medium severity, CVSS 4.9 | Vulnix