What’s Vulnerable › Vulnerabilities
CVE-2021-28207: ASUS BMC's firmware: path traversal - Get Help file function
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-04-06 · updated 2026-06-17
- Weakness: CWE-22
Description
The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
Affected products
- ASUS Asmb9-Ikvm Firmware: 1.11.12
- ASUS E700 G4 Firmware: 1.14.1
- ASUS Esc4000 Dhd G4 Firmware: 1.13.7
- ASUS Esc4000 G4 Firmware: 1.15.2
- ASUS Esc4000 G4X Firmware: 1.11.6
- ASUS Esc8000 G4/10G Firmware: 1.15.4
- ASUS Esc8000 G4 Firmware: 1.15.4
- ASUS Knpa-U16 Firmware: 1.13.4
- ASUS Pro E800 G4 Firmware: 1.14.2
- ASUS Rs100-E10-Pi2 Firmware: 1.13.6
- ASUS Rs300-E10-Ps4 Firmware: 1.13.6
- ASUS Rs300-E10-Rs4 Firmware: 1.13.6
- ASUS Rs500-E9-Ps4 Firmware: 1.15.4
- ASUS Rs500-E9-Rs4-U Firmware: 1.15.4
- ASUS Rs500-E9-Rs4 Firmware: 1.15.4
- ASUS Rs500A-E10-Ps4 Firmware: 1.15.2
- ASUS Rs500A-E10-Rs4 Firmware: 1.15.2
- ASUS Rs500A-E9-Ps4 Firmware: 1.14.1
- ASUS Rs500A-E9-Rs4 Firmware: 1.14.1
- ASUS Rs500A-E9 Rs4 U Firmware: 1.14.1
- ASUS Rs520-E9-Rs12-E Firmware: 1.15.3
- ASUS Rs520-E9-Rs8 Firmware: 1.15.3
- ASUS Rs700-E9-Rs12 Firmware: 1.11.5
- ASUS Rs700-E9-Rs4 Firmware: 1.09
- ASUS Rs700A-E9-Rs12V2 Firmware: 1.15.1
- ASUS Rs700A-E9-Rs4 Firmware: 1.10.0
- ASUS Rs700A-E9-Rs4V2 Firmware: 1.15.1
- ASUS Rs720-E9-Rs12-E Firmware: 1.15.2
- ASUS Rs720-E9-Rs24-U Firmware: 1.14.3
- ASUS Rs720-E9-Rs8-G Firmware: 1.15.2
References
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- https://www.asus.com/tw/support/callus/
- https://www.twcert.org.tw/tw/cp-132-4577-60153-1.html
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- https://www.asus.com/tw/support/callus/
- https://www.twcert.org.tw/tw/cp-132-4577-60153-1.html
Get alerted when CVE-2021-28207 or the next vulnerability affects your stack