Description
The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ASUS | BMC firmware for Z10PR-D16 | 1.14.51 | — |
| ASUS | BMC firmware for ASMB8-iKVM | 1.14.51 | — |
| ASUS | BMC firmware for Z10PE-D16 WS | 1.14.2 | — |