VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVReported exploited: VulnCheck KEV since Published CVSS 4.9 mediumEPSS 1.9% probability of exploitation in 30 days
ASUS
CVE-2021-28199: ASUS BMC's firmware: buffer overflow - Modify user’s information function
Is it exploited?
Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .
VulnCheck KEV lists it since . It cites 1 public report, the first from .
EPSS score, percentile 79.4 of all scored records. A probability estimated by FIRST, not a report of exploitation.
How severe?
4.9Medium
CVSS v3.1 base score, given by the CNA
What should I do?
update BMC's firmwares to the following versions: ESC4000 G4X 1.15.6 RS700-E9-RS12 1.15.4 RS100-E10-PI2 1.15.3 RS300-E10-PS4 1.15.3 RS300-E10-RS4 1.15.3 RS500A-E9-PS4 … Full textSolution from the CVE record.
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
ASUS BMC's firmware: buffer overflow - Modify user’s information function
The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.