Medium severity · published Apr 6, 2021
CVE-2021-28206
The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter
4.9
CVSS
2%
EPSS
No
On KEV
Description
The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Asmb9-ikvm Firmware · Asus
1.11.12 · source: NVD
EG
E700 G4 Firmware · Asus
1.14.1 · source: NVD
ED
Esc4000 Dhd G4 Firmware · Asus
1.13.7 · source: NVD
EG
Esc4000 G4 Firmware · Asus
1.15.2 · source: NVD
EG
Esc4000 G4x Firmware · Asus
1.11.6 · source: NVD
EG
Esc8000 G4 Firmware · Asus
1.15.4 · source: NVD
EG
Esc8000 G4/10g Firmware · Asus
1.15.4 · source: NVD
KF
Knpa-u16 Firmware · Asus
1.13.4 · source: NVD
PE
Pro E800 G4 Firmware · Asus
1.14.2 · source: NVD
RF
Rs100-e10-pi2 Firmware · Asus
1.13.6 · source: NVD
RF
Rs300-e10-ps4 Firmware · Asus
1.13.6 · source: NVD
RF
Rs300-e10-rs4 Firmware · Asus
1.13.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-28206
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-28206
Vendor Advisory
https://www.asus.com/content/ASUS-Product-Security-Advisory/
Vendor Advisory
https://www.asus.com/tw/support/callus/
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-4576-422ac-1.html
More from Asmb9-ikvm Firmware
4.9
CVE-2021-28209
The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter
4.9
CVE-2021-28208
The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter
4.9
CVE-2021-28207
The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter
4.9
CVE-2021-28202
The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability
4.9
CVE-2021-28201
The Service configuration-1 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability