CVE-2021-25138: hpe cloudline_cl3100_gen10_server_firmware Classic Buffer Overflow

Vulnerability summary

CVE-2021-25138 is a high (CVSS 7.8) Classic Buffer Overflow vulnerability in hpe cloudline_cl3100_gen10_server_firmware. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26% of scored vulnerabilities.

Timeline

1. 29-01-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice uploadsshkey function.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.