ASUS BMC Firmware Path Traversal Vulnerability (CNVD-2021-36266)

ASUS BMC Firmware is a firmware from Asus China. The ASUS BMC Firmware suffers from a path traversal vulnerability that stems from the Record video file function not filtering specific parameters. A remote attacker could use this vulnerability to gain administrator privileges and then traverse...

CVE-2021-28205

The specific function in ASUS BMC’s firmware Web management page Delete SOL video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28207

The specific function in ASUS BMC’s firmware Web management page Get Help file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28208

The specific function in ASUS BMC’s firmware Web management page Get video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28209

The specific function in ASUS BMC’s firmware Web management page Delete video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28205

The specific function in ASUS BMC’s firmware Web management page Delete SOL video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28209

The specific function in ASUS BMC’s firmware Web management page Delete video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28206

The specific function in ASUS BMC’s firmware Web management page Record video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Delete video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Get Help file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Record video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Get video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

Path traversal

The specific function in ASUS BMC’s firmware Web management page Delete SOL video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28209 ASUS BMC's firmware: path traversal - Delete video file function

The specific function in ASUS BMC’s firmware Web management page Delete video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28209

The CVE-2021-28209 issue affects ASUS BMC firmware Web management (Delete video file function). A parameter is not properly filtered, enabling path traversal to access system files. According to multiple sources, remote attackers with administrator privileges can exploit this to read restricted f...

CVE-2021-28208 ASUS BMC's firmware: path traversal - Get video file function

The specific function in ASUS BMC’s firmware Web management page Get video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28207

The CVE describes a path traversal vulnerability in ASUS BMC firmware: the Web management page Get Help file function does not validate a parameter, allowing a remote attacker with administrator permissions to access system files. This is due to insufficient input filtering on the affected functi...

CVE-2021-28207 ASUS BMC's firmware: path traversal - Get Help file function

The specific function in ASUS BMC’s firmware Web management page Get Help file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...

CVE-2021-28206

ASUS BMC firmware Web management page vulnerability in the Record video file function allows path traversal due to improper parameter filtering. A remote attacker with administrator privileges could access system files. The CVE entry notes this results in high confidentiality impact, but there is...

CVE-2021-28206 ASUS BMC's firmware: path traversal - Record video file function

The specific function in ASUS BMC’s firmware Web management page Record video file function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files...