CVE-2021-28185: ASUS ASMB8-Ikvm Firmware

Medium severity, CVSS 4.9. EPSS: 1.8% chance of exploitation in the next 30 days.

The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected products

• ASUS ASMB8-Ikvm Firmware: version 1.14.51 only
• ASUS z10pe-d16 Ws Firmware: version 1.14.2 only
• ASUS z10pr-d16 Firmware: version 1.14.51 only

Published 2021-04-06. Last modified 2026-06-17.