CVE-2021-28208 | Severity.io

Description

The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.

Related CPE's

asmb9-ikvm_firmware

Vulnerable

rs720a-e9-rs24-e_firmware

Vulnerable

rs720a-e9-rs24-e

rs700a-e9-rs4_firmware

Vulnerable

rs700-e9-rs4_firmware

Vulnerable

esc4000_g4x_firmware

Vulnerable

rs700-e9-rs12_firmware

Vulnerable

rs100-e10-pi2_firmware

Vulnerable

rs300-e10-ps4_firmware

Vulnerable

rs300-e10-rs4_firmware

Vulnerable

rs500a-e9-ps4_firmware

Vulnerable

rs500a-e9-rs4_firmware

Vulnerable

rs500a-e9_rs4_u_firmware

Vulnerable

rs500a-e9_rs4_u

e700_g4_firmware

Vulnerable

ws_c422_pro\/se_firmware

Vulnerable

ws_c422_pro\/se

ws_x299_pro\/se_firmware

Vulnerable

ws_x299_pro\/se

z11pa-u12_firmware

Vulnerable

z11pa-u12\/10g-2s_firmware

Vulnerable

z11pa-u12\/10g-2s

knpa-u16_firmware

Vulnerable

esc4000_dhd_g4_firmware

Vulnerable

esc4000_g4_firmware

Vulnerable

rs720q-e9-rs24-s_firmware

Vulnerable

rs720q-e9-rs24-s

rs720q-e9-rs8_firmware

Vulnerable

rs720q-e9-rs8-s_firmware

Vulnerable

rs720q-e9-rs8-s

z11pa-d8_firmware

Vulnerable

z11pa-d8c_firmware

Vulnerable

rs720-e9-rs24-u_firmware

Vulnerable

rs720-e9-rs24-u

rs720-e9-rs8-g_firmware

Vulnerable

rs500-e9-ps4_firmware

Vulnerable

pro_e800_g4_firmware

Vulnerable

rs500-e9-rs4_firmware

Vulnerable

rs500-e9-rs4-u_firmware

Vulnerable

rs520-e9-rs12-e_firmware

Vulnerable

rs520-e9-rs12-e

rs520-e9-rs8_firmware

Vulnerable

esc8000_g4_firmware

Vulnerable

esc8000_g4\/10g_firmware

Vulnerable

esc8000_g4\/10g

rs720-e9-rs12-e_firmware

Vulnerable

rs720-e9-rs12-e

ws_c621e_sage_firmware

Vulnerable

rs500a-e10-ps4_firmware

Vulnerable

rs500a-e10-rs4_firmware

Vulnerable

rs700a-e9-rs12v2_firmware

Vulnerable

rs700a-e9-rs12v2

rs700a-e9-rs4v2_firmware

Vulnerable

rs700a-e9-rs4v2

rs720a-e9-rs12v2_firmware

Vulnerable

rs720a-e9-rs12v2

rs720a-e9-rs24v2_firmware

Vulnerable

rs720a-e9-rs24v2

z11pr-d16_firmware

Vulnerable

References

https://www.asus.com/content/ASUS-Product-Security-Advisory/

Vendor Advisory

https://www.asus.com/tw/support/callus/

Vendor Advisory

https://www.twcert.org.tw/tw/cp-132-4578-e5d74-1.html

Third Party Advisory

Weaknesses

[email protected]

Primary

CWE-22

[email protected]

Secondary

CWE-22

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.9 · Medium

CVSS V3.1
CVSS V3.0
CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-04-06T05:15:17.393

4 years ago

Last modified

2021-04-14T13:49:59.130

4 years ago