VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 6, 2021· Updated Sep 16, 2024

ASUS BMC's firmware: path traversal - Get Help file function

CVE-2021-28207

Description

The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ASUS BMC firmware Web management "Get Help file" function lacks input sanitization, allowing authenticated admin to read system files via path traversal.

Vulnerability

The "Get Help file function" in the Web management interface of ASUS BMC firmware versions prior to the fixed releases (e.g., ASMB9-iKVM < 1.15.3, RS700-E9-RS4 < 1.15.4, etc.) does not sanitize the specific parameter [1]. An attacker with administrator privileges can inject path traversal sequences to navigate outside the intended directory.

Exploitation

An attacker must first obtain administrator permissions on the BMC Web interface. With those privileges, they can send a crafted request to the "Get Help file" endpoint, manipulating the vulnerable parameter to include '../' sequences [1]. No further authentication or user interaction is required beyond the admin session.

Impact

Successful exploitation allows reading arbitrary files from the BMC filesystem, including sensitive configuration or credential files [1]. The confidentiality of the system is compromised, though integrity and availability are not directly affected.

Mitigation

ASUS has released fixed firmware versions for many affected products, e.g., ASMB9-iKVM 1.15.3 and RS700-E9-RS4 1.15.4 [1]. Administrators should update to the latest firmware from ASUS support. No workaround is mentioned; the fix is to apply the firmware update.

References
  1. ASUS BMC's firmware: path traversal - 取得Help文件功能

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

45
  • Supermicro/BMC firmwarellm-fuzzy
  • ASUS/BMC firmware for ASMB9-iKVMv5
    Range: 1.11.12
  • ASUS/BMC firmware for E700 G4v5
    Range: 1.14.1
  • ASUS/BMC firmware for ESC4000 DHD G4v5
    Range: 1.13.7
  • ASUS/BMC firmware for ESC4000 G4v5
    Range: 1.15.2
  • ASUS/BMC firmware for ESC4000 G4Xv5
    Range: 1.11.6
  • ASUS/BMC firmware for ESC8000 G4v5
    Range: 1.15.4
  • ASUS/BMC firmware for ESC8000 G4/10Gv5
    Range: 1.15.4
  • ASUS/BMC firmware for KNPA-U16v5
    Range: 1.13.4
  • ASUS/BMC firmware for Pro E800 G4v5
    Range: 1.14.2
  • ASUS/BMC firmware for RS100-E10-PI2v5
    Range: 1.13.6
  • ASUS/BMC firmware for RS300-E10-PS4v5
    Range: 1.13.6
  • ASUS/BMC firmware for RS300-E10-RS4v5
    Range: 1.13.6
  • ASUS/BMC firmware for RS500A-E10-PS4v5
    Range: 1.15.2
  • ASUS/BMC firmware for RS500A-E10-RS4v5
    Range: 1.15.2
  • ASUS/BMC firmware for RS500A-E9-PS4v5
    Range: 1.14.1
  • ASUS/BMC firmware for RS500A-E9 RS4v5
    Range: 1.14.1
  • ASUS/BMC firmware for RS500A-E9-RS4v5
    Range: 1.14.1
  • ASUS/BMC firmware for RS500-E9-PS4v5
    Range: 1.15.4
  • ASUS/BMC firmware for RS500-E9-RS4v5
    Range: 1.15.4
  • ASUS/BMC firmware for RS500-E9-RS4-Uv5
    Range: 1.15.4
  • ASUS/BMC firmware for RS520-E9-RS12-Ev5
    Range: 1.15.3
  • ASUS/BMC firmware for RS520-E9-RS8v5
    Range: 1.15.3
  • ASUS/BMC firmware for RS700A-E9-RS12V2v5
    Range: 1.15.1
  • ASUS/BMC firmware for RS700A-E9-RS4v5
    Range: 1.10.0
  • ASUS/BMC firmware for RS700A-E9-RS4V2v5
    Range: 1.15.1
  • ASUS/BMC firmware for RS700-E9-RS12v5
    Range: 1.11.5
  • ASUS/BMC firmware for RS700-E9-RS4v5
    Range: 1.09
  • ASUS/BMC firmware for RS720A-E9-RS12V2v5
    Range: 1.15.2
  • ASUS/BMC firmware for RS720A-E9-RS24-Ev5
    Range: 1.10.3
  • ASUS/BMC firmware for RS720A-E9-RS24V2v5
    Range: 1.15.1
  • ASUS/BMC firmware for RS720-E9-RS12-Ev5
    Range: 1.15.2
  • ASUS/BMC firmware for RS720-E9-RS24-Uv5
    Range: 1.14.3
  • ASUS/BMC firmware for RS720-E9-RS8-Gv5
    Range: 1.15.2
  • ASUS/BMC firmware for RS720Q-E9-RS24-Sv5
    Range: 1.15.0
  • ASUS/BMC firmware for RS720Q-E9-RS8v5
    Range: 1.15.0
  • ASUS/BMC firmware for RS720Q-E9-RS8-Sv5
    Range: 1.15.0
  • ASUS/BMC firmware for WS C422 PRO/SEv5
    Range: 1.14.1
  • ASUS/BMC firmware for WS C621E SAGEv5
    Range: 1.15.1
  • ASUS/BMC firmware for WS X299 PRO/SEv5
    Range: 1.14.1
  • ASUS/BMC firmware for Z11PA-D8v5
    Range: 1.14.1
  • ASUS/BMC firmware for Z11PA-D8Cv5
    Range: 1.14.1
  • ASUS/BMC firmware for Z11PA-U12v5
    Range: 1.15.1
  • ASUS/BMC firmware for Z11PA-U12/10G-2Sv5
    Range: 1.15.1
  • ASUS/BMC firmware for Z11PR-D16v5
    Range: 1.15.3

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.