CVE-2021-28205

published 2021-04-06

CVE-2021-28205: The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the…

Priority P4 29 medium 4.9 CVSS 3.1

AV N AC L PR H UI N S U C H I N A N

The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
asus	asmb8-ikvm_firmware	—	—
asus	bmc_firmware_for_asmb8-ikvm	—	—
asus	bmc_firmware_for_z10pe-d16_ws	—	—
asus	bmc_firmware_for_z10pr-d16	—	—
asus	z10pe-d16_ws_firmware	—	—
asus	z10pr-d16_firmware	—	—

CVSS provenance

nvd v3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 6.8 MEDIUM AV:N/AC:L/Au:S/C:C/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22