CVE-2021-28209: medium-severity vulnerability in ASUS BMC firmware for ASMB9-iKVM
ASUS BMC's firmware: path traversal - Delete video file function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in ASUS BMC's web management interface allows an authenticated administrator to delete or access files outside the intended directory by manipulating file path parameters. This could expose sensitive system files.
Path traversal vulnerability in the Delete video file function of ASUS BMC firmware's web management page due to insufficient input validation on file path parameters. Requires valid administrator credentials; remote attackers can exploit this to traverse directories and access arbitrary system files.
In the same product, most dangerous first.