CVE-2021-28200 : What You Need to Know

A buffer overflow vulnerability exists in ASUS BMC's firmware due to lack of string length verification, allowing remote attackers to terminate the web service.

Understanding CVE-2021-28200

This CVE relates to a buffer overflow vulnerability in ASUS BMC's firmware.

What is CVE-2021-28200?

The CD media configuration function in ASUS BMC's firmware Web management page does not verify user-entered string lengths, leading to a buffer overflow vulnerability.

The Impact of CVE-2021-28200

With a CVSS base score of 4.9, this vulnerability has a medium severity level. It requires high privileges and can result in high availability impact.

Technical Details of CVE-2021-28200

The vulnerability is classified as CWE-120 Buffer Overflow. It has a low attack complexity and can be exploited over a network.

Vulnerability Description

The buffer overflow vulnerability in ASUS BMC's firmware allows remote attackers to gain privileged permissions and terminate the web service.

Affected Systems and Versions

Various ASUS BMC firmware versions are affected, including 1.09, 1.10.0, 1.10.3, 1.11.5, 1.11.6, 1.11.12, and others.

Exploitation Mechanism

Attackers can exploit this vulnerability by providing string inputs of excessive length, leading to a buffer overflow situation.

Mitigation and Prevention

To address CVE-2021-28200, ASUS recommends updating BMC firmware to the following versions:

ESC4000 G4X 1.15.6
RS700-E9-RS12 1.15.4
RS100-E10-PI2 1.15.3
RS300-E10-PS4 1.15.3
and more.

Immediate Steps to Take

Immediate actions include applying the recommended firmware updates to mitigate the vulnerability.

Long-Term Security Practices

Regularly check for firmware updates and implement security best practices to protect against similar vulnerabilities.

Patching and Updates

Ensure timely application of firmware patches and updates provided by ASUS to maintain system security.