CVE-2021-28209 ASUS BMC's firmware: path traversal - Delete video file function

Medium 4.9 Published 6 Apr 2021 Updated 16 Sep 2024

Remote attackers with admin privileges can exploit path traversal in the video deletion function to access or modify system files.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-28209?

CVE-2021-28209 is a medium-severity path traversal vulnerability in ASUS BMC firmware for ASMB9-iKVM, published on 6 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.

Weakness: CWE-22

Which versions are affected by CVE-2021-28209?

It affects 44 products.

Products include Asus Asmb9-Ikvm Firmware, Asus E700 G4 Firmware, Asus Esc4000 Dhd G4 Firmware, Asus Esc4000 G4 Firmware, Asus Esc4000 G4x Firmware, Asus Esc8000 G4\/10g Firmware and 38 more.

How do I fix CVE-2021-28209?

No fix has been published for CVE-2021-28209 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-28209 being exploited?

There is no known exploitation of CVE-2021-28209 in the wild and no public exploit code.

Sources

Also known as GHSA-wm46-gchr-6vgg.