Path traversal

2021-04-0605:15:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.9%

JSON

The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.

CPENameOperatorVersion
asmb9-ikvm_firmwareeq1.11.12
e700_g4_firmwareeq1.14.1
esc4000_dhd_g4_firmwareeq1.13.7
esc4000_g4_firmwareeq1.15.2
esc4000_g4x_firmwareeq1.11.6
esc8000_g4\\/10g_firmwareeq1.15.4
esc8000_g4_firmwareeq1.15.4
knpa-u16_firmwareeq1.13.4
pro_e800_g4_firmwareeq1.14.2
rs100-e10-pi2_firmwareeq1.13.6

Name	Operator	Version
asmb9-ikvm_firmware	eq	1.11.12
e700_g4_firmware	eq	1.14.1
esc4000_dhd_g4_firmware	eq	1.13.7
esc4000_g4_firmware	eq	1.15.2
esc4000_g4x_firmware	eq	1.11.6
esc8000_g4\\/10g_firmware	eq	1.15.4
esc8000_g4_firmware	eq	1.15.4
knpa-u16_firmware	eq	1.13.4
pro_e800_g4_firmware	eq	1.14.2
rs100-e10-pi2_firmware	eq	1.13.6