CVE-2021-28209

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-282107.8An unlimited recursion in DxeCore in EDK II.CVE-2021-282116.7A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.CVE-2021-282137.5Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.CVE-2021-282167.8BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.CVE-2021-282338.8Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c.CVE-2021-282359.8Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.CVE-2021-282367.5LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c.CVE-2021-282379.8LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13.CVE-2021-282428.8SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by CVE-2021-282457.5PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information throu CVE-2021-282467.8CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regula CVE-2021-282475.4CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is ab