ASUS BMC's firmware: buffer overflow - SMTP configuration function

Vulnerability

The SMTP configuration function in ASUS BMC’s Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. This flaw resides in the firmware of multiple ASUS server models (Z10PR-D16, ASMB8-iKVM, Z10PE-D16 WS) versions 1.14.51, 1.14.51, and 1.14.2 respectively [1]. An attacker with administrative privilege can trigger the overflow by supplying an overly long input string to the SMTP settings field, leading to abnormal termination of the Web service.

Exploitation

To exploit this vulnerability, the attacker must first obtain privileged remote access to the BMC Web management interface. With that access, they navigate to the SMTP configuration page and submit a string that exceeds the buffer capacity. No user interaction or race condition is required; the overflow occurs immediately upon submission. The network position can be remote, as the BMC interface is typically exposed over the network [1].

Impact

On successful exploitation, the Web service crashes, resulting in a denial-of-service condition. The impact is limited to availability (C:N/I:N/A:H) per the CVSS score [1]. No data disclosure or remote code execution is reported; the overflow only disrupts the service.

Mitigation

ASUS has released firmware updates to address this vulnerability: Z10PR-D16 to version 1.16.1, ASMB8-iKVM to version 1.16.1, and Z10PE-D16 WS to version 1.16.1 [1]. Users should update their BMC firmware to these patched versions. No workarounds are documented; the fix is the sole mitigation.