CVE-2021-28201: ASUS ASMB9-Ikvm Firmware

Medium severity, CVSS 4.9. EPSS: 1.8% chance of exploitation in the next 30 days.

The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

Affected products

• ASUS ASMB9-Ikvm Firmware: version 1.11.12 only
• ASUS e700 g4 Firmware: version 1.14.1 only
• ASUS ESC4000 Dhd g4 Firmware: version 1.13.7 only
• ASUS ESC4000 g4 Firmware: version 1.15.2 only
• ASUS ESC4000 g4x Firmware: version 1.11.6 only
• ASUS ESC8000 g4/10g Firmware: version 1.15.4 only
• ASUS ESC8000 g4 Firmware: version 1.15.4 only
• ASUS Knpa-u16 Firmware: version 1.13.4 only
• ASUS Pro e800 g4 Firmware: version 1.14.2 only
• ASUS RS100-e10-PI2 Firmware: version 1.13.6 only
• ASUS RS300-e10-PS4 Firmware: version 1.13.6 only
• ASUS RS300-e10-RS4 Firmware: version 1.13.6 only
• ASUS RS500-e9-PS4 Firmware: version 1.15.4 only
• ASUS RS500-e9-RS4-U Firmware: version 1.15.4 only
• ASUS RS500-e9-RS4 Firmware: version 1.15.4 only
• ASUS RS500A-e10-PS4 Firmware: version 1.15.2 only
• ASUS RS500A-e10-RS4 Firmware: version 1.15.2 only
• ASUS RS500A-e9-PS4 Firmware: version 1.14.1 only
• ASUS RS500A-e9-RS4 Firmware: version 1.14.1 only
• ASUS RS500A-e9 RS4 U Firmware: version 1.14.1 only
• ASUS RS520-e9-RS12-E Firmware: version 1.15.3 only
• ASUS RS520-e9-RS8 Firmware: version 1.15.3 only
• ASUS RS700-e9-RS12 Firmware: version 1.11.5 only
• ASUS RS700-e9-RS4 Firmware: version 1.09 only
• ASUS RS700A-e9-RS12V2 Firmware: version 1.15.1 only
• and 19 more

Published 2021-04-06. Last modified 2026-06-17.