The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
References
| Link | Resource |
|---|---|
| https://www.asus.com/content/ASUS-Product-Security-Advisory/ | Vendor Advisory |
| https://www.asus.com/tw/support/callus/ | Vendor Advisory |
| https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
14 Apr 2021, 12:48
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:asus:z10pe-d16_ws_firmware:1.14.2:*:*:*:*:*:*:* cpe:2.3:h:asus:z10pe-d16_ws:-:*:*:*:*:*:*:* cpe:2.3:h:asus:asmb8-ikvm:-:*:*:*:*:*:*:* cpe:2.3:h:asus:z10pr-d16:-:*:*:*:*:*:*:* cpe:2.3:o:asus:z10pr-d16_firmware:1.14.51:*:*:*:*:*:*:* cpe:2.3:o:asus:asmb8-ikvm_firmware:1.14.51:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 4.9 |
| References | (CONFIRM) https://www.asus.com/tw/support/callus/ - Vendor Advisory | |
| References | (CONFIRM) https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html - Third Party Advisory | |
| References | (CONFIRM) https://www.asus.com/content/ASUS-Product-Security-Advisory/ - Vendor Advisory | |
| CWE | CWE-22 |
06 Apr 2021, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-04-06 05:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-28205
Mitre link : CVE-2021-28205
CVE.ORG link : CVE-2021-28205
JSON object : View
Products Affected
asus
- z10pr-d16
- z10pr-d16_firmware
- asmb8-ikvm
- z10pe-d16_ws_firmware
- asmb8-ikvm_firmware
- z10pe-d16_ws
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')