CVE-2021-28206ASUS BMC's firmware: path traversal - Record video file function
- 4.9MediumCVSS base score
- 2.0%Exploitation in 30 daysEPSS · top 19% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
Timeline
ID reserved
By twcert
- 25 days later
· 25 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| twcertCNA (assigner) | 3.1 | Medium4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.0% · top 19% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.9.
Affected products
ASUS · BMC firmware for ASMB9-iKVM
- affected 1.11.12
ASUS · BMC firmware for RS720A-E9-RS24-E
- affected 1.10.3
ASUS · BMC firmware for RS700A-E9-RS4
- affected 1.10.0
ASUS · BMC firmware for RS700-E9-RS4
- affected 1.09
ASUS · BMC firmware for ESC4000 G4X
- affected 1.11.6
ASUS · BMC firmware for RS700-E9-RS12
- affected 1.11.5
ASUS · BMC firmware for RS100-E10-PI2
- affected 1.13.6
ASUS · BMC firmware for RS300-E10-PS4
- affected 1.13.6
ASUS · BMC firmware for RS300-E10-RS4
- affected 1.13.6
ASUS · BMC firmware for RS500A-E9-PS4
- affected 1.14.1
ASUS · BMC firmware for RS500A-E9-RS4
- affected 1.14.1
ASUS · BMC firmware for RS500A-E9 RS4
- affected 1.14.1
ASUS · BMC firmware for E700 G4
- affected 1.14.1
ASUS · BMC firmware for WS C422 PRO/SE
- affected 1.14.1
ASUS · BMC firmware for WS X299 PRO/SE
- affected 1.14.1
ASUS · BMC firmware for Z11PA-U12
- affected 1.15.1
ASUS · BMC firmware for Z11PA-U12/10G-2S
- affected 1.15.1
ASUS · BMC firmware for KNPA-U16
- affected 1.13.4
ASUS · BMC firmware for ESC4000 DHD G4
- affected 1.13.7
ASUS · BMC firmware for ESC4000 G4
- affected 1.15.2
ASUS · BMC firmware for RS720Q-E9-RS24-S
- affected 1.15.0
ASUS · BMC firmware for RS720Q-E9-RS8
- affected 1.15.0
ASUS · BMC firmware for RS720Q-E9-RS8-S
- affected 1.15.0
ASUS · BMC firmware for Z11PA-D8
- affected 1.14.1
ASUS · BMC firmware for Z11PA-D8C
- affected 1.14.1
ASUS · BMC firmware for RS720-E9-RS24-U
- affected 1.14.3
ASUS · BMC firmware for RS720-E9-RS8-G
- affected 1.15.2
ASUS · BMC firmware for RS500-E9-PS4
- affected 1.15.4
ASUS · BMC firmware for Pro E800 G4
- affected 1.14.2
ASUS · BMC firmware for RS500-E9-RS4
- affected 1.15.4
ASUS · BMC firmware for RS500-E9-RS4-U
- affected 1.15.4
ASUS · BMC firmware for RS520-E9-RS12-E
- affected 1.15.3
ASUS · BMC firmware for RS520-E9-RS8
- affected 1.15.3
ASUS · BMC firmware for ESC8000 G4
- affected 1.15.4
ASUS · BMC firmware for ESC8000 G4/10G
- affected 1.15.4
ASUS · BMC firmware for RS720-E9-RS12-E
- affected 1.15.2
ASUS · BMC firmware for WS C621E SAGE
- affected 1.15.1
ASUS · BMC firmware for RS500A-E10-PS4
- affected 1.15.2
ASUS · BMC firmware for RS500A-E10-RS4
- affected 1.15.2
ASUS · BMC firmware for RS700A-E9-RS12V2
- affected 1.15.1
ASUS · BMC firmware for RS700A-E9-RS4V2
- affected 1.15.1
ASUS · BMC firmware for RS720A-E9-RS12V2
- affected 1.15.2
ASUS · BMC firmware for RS720A-E9-RS24V2
- affected 1.15.1
ASUS · BMC firmware for Z11PR-D16
- affected 1.15.3
What to do
Solution: update BMC's firmwares to the following versions: ESC4000 G4X 1.15.6 RS700-E9-RS12 1.15.4 RS100-E10-PI2 1.15.3 RS300-E10-PS4 1.15.3 RS300-E10-RS4 1.15.3 RS500A-E9-PS4 1.14.2 RS500A-E9-RS4 1.14.2 RS500A-E9 RS4 U 1.14.2 E700 G4 1.14.2 WS C422 PRO/SE 1.14.2 WS X299 PRO/SE 1.14.2 Z11PA-U12 1.15.2 KNPA-U16 1.14.5 ESC4000 DHD G4 1.15.2 ESC4000 G4 1.15.6 RS720Q-E9-RS24-S 1.15.1 RS720Q-E9-RS8 1.15.1 RS720Q-E9-RS8-S 1.15.1 Z11PA-D8 1.15.2 Z11PA-D8C 1.15.2 RS720-E9-RS24-U 1.15.5 RS720-E9-RS8-G 1.15.4 RS500-E9-PS4 1.15.5 Pro E800 G4 1.15.2 RS500-E9-RS4 1.15.5 RS500-E9-RS4-U 1.15.5 RS520-E9-RS12-E 1.15.4 RS520-E9-RS8 1.15.4 ESC8000 G4 1.15.5 ESC8000 G4/10G 1.15.5 RS720-E9-RS12-E 1.15.3 WS C621E SAGE 1.15.3 RS500A-E10-PS4 1.15.3 RS500A-E10-RS4 1.15.3 RS700A-E9-RS12V2 1.15.3 RS700A-E9-RS4V2 1.15.3 RS720A-E9-RS12V2 1.15.3 RS720A-E9-RS24V2 1.15.3 Z11PR-D16 1.15.4
References
References3
- https://www.asus.com/content/ASUS-Product-Security-Advisory/ (opens in a new tab)x_refsource_MISCx_transferred
- https://www.asus.com/tw/support/callus/ (opens in a new tab)x_refsource_MISCx_transferred
- https://www.twcert.org.tw/tw/cp-132-4576-422ac-1.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2021-14896 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2021-28206)Record last updated .