CVE-2021-28206: medium-severity vulnerability in ASUS BMC firmware for ASMB9-iKVM
ASUS BMC's firmware: path traversal - Record video file function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
ASUS BMC firmware's video recording feature doesn't properly validate file paths, allowing an authenticated administrator to access files outside the intended directory using path traversal techniques.
Path traversal vulnerability (CWE-22) in ASUS BMC web management interface's record video file function lacks input validation on file path parameters. An authenticated attacker with administrator credentials can exploit this to read arbitrary system files by manipulating path traversal sequences.
In the same product, most dangerous first.