ASUS BMC's firmware: path traversal - Delete SOL video file function

Vulnerability

The ASUS BMC firmware web management page contains a path traversal vulnerability in the "Delete SOL video file" function. The specific function does not properly filter the user-supplied parameter, allowing directory traversal sequences. Affected products and firmware versions include Z10PR-D16 (firmware 1.14.51), ASMB8-iKVM (firmware 1.14.51), and Z10PE-D16 WS (firmware 1.14.2) [1].

Exploitation

An attacker must first obtain administrator-level privileges on the BMC web interface. With those privileges, the attacker can send crafted HTTP requests to the delete video function, inserting path traversal sequences (e.g., ../) in the vulnerable parameter. No additional user interaction or network position beyond authenticated access is required [1].

Impact

Successful exploitation allows the attacker to read arbitrary files on the underlying operating system. This leads to information disclosure of sensitive system files, configuration data, or other protected content. The CVSS score is 4.9 (Medium) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no impact on integrity or availability [1].

Mitigation

ASUS has released updated firmware versions to address this issue. Users should update the affected products to the corresponding fixed firmware: Z10PR-D16 to 1.16.1, ASMB8-iKVM to 1.16.1, and Z10PE-D16 WS to 1.16.1 [1]. No workarounds are documented in the available references.