ASUS BMC's firmware: buffer overflow - Radius configuration function

Vulnerability

The Radius configuration function in ASUS BMC's firmware Web management page does not verify the string length entered by users, resulting in a buffer overflow vulnerability [1]. This function is accessible via the web interface under privileged credentials. Affected firmware versions include Z10PR-D16 1.14.51, ASMB8-iKVM 1.14.51, and Z10PE-D16 WS 1.14.2 [1].

Exploitation

An attacker must first obtain privileged administrative access to the BMC's web management interface. Once authenticated, the attacker can send a specially crafted input to the Radius configuration parameter that exceeds the expected buffer length, triggering a buffer overflow condition [1]. No user interaction beyond initial authentication is required.

Impact

A successful overflow causes the web service to abnormally terminate, resulting in a denial-of-service (DoS) condition affecting the availability of the management interface [1]. The CVSS v3.1 base score is 4.9 (Medium), with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H [1]. No confidentiality or integrity impact is reported.

Mitigation

ASUS has released updated firmware versions that address this vulnerability: Z10PR-D16 1.16.1, ASMB8-iKVM 1.16.1, and Z10PE-D16 WS 1.16.1 [1]. Users should update to these versions or later. No workarounds are documented in the available references.