CVE-2021-28199

MEDIUM EXPLOITED

ASUS BMC Firmware - Buffer Overflow in User Information Modification

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-28199 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://www.asus.com/tw/support/callus/
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-4569-6b391-1.html

Scores

CVSS v3 4.9
EPSS 0.0181
EPSS Percentile 76.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Details

VulnCheck KEV 2026-06-22
CWE
CWE-120
Status published
Products (44)
asus/asmb9-ikvm_firmware 1.11.12
asus/e700_g4_firmware 1.14.1
asus/esc4000_dhd_g4_firmware 1.13.7
asus/esc4000_g4_firmware 1.15.2
asus/esc4000_g4x_firmware 1.11.6
asus/esc8000_g4\/10g_firmware 1.15.4
asus/esc8000_g4_firmware 1.15.4
asus/knpa-u16_firmware 1.13.4
asus/pro_e800_g4_firmware 1.14.2
asus/rs100-e10-pi2_firmware 1.13.6
... and 34 more
Published Apr 06, 2021
Tracked Since Feb 18, 2026