CVE-2021-28208: ASUS ASMB9-Ikvm Firmware

Medium severity, CVSS 4.9. EPSS: 1.9% chance of exploitation in the next 30 days.

The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.

Affected products

• ASUS ASMB9-Ikvm Firmware: version 1.11.12 only
• ASUS e700 g4 Firmware: version 1.14.1 only
• ASUS ESC4000 Dhd g4 Firmware: version 1.13.7 only
• ASUS ESC4000 g4 Firmware: version 1.15.2 only
• ASUS ESC4000 g4x Firmware: version 1.11.6 only
• ASUS ESC8000 g4/10g Firmware: version 1.15.4 only
• ASUS ESC8000 g4 Firmware: version 1.15.4 only
• ASUS Knpa-u16 Firmware: version 1.13.4 only
• ASUS Pro e800 g4 Firmware: version 1.14.2 only
• ASUS RS100-e10-PI2 Firmware: version 1.13.6 only
• ASUS RS300-e10-PS4 Firmware: version 1.13.6 only
• ASUS RS300-e10-RS4 Firmware: version 1.13.6 only
• ASUS RS500-e9-PS4 Firmware: version 1.15.4 only
• ASUS RS500-e9-RS4-U Firmware: version 1.15.4 only
• ASUS RS500-e9-RS4 Firmware: version 1.15.4 only
• ASUS RS500A-e10-PS4 Firmware: version 1.15.2 only
• ASUS RS500A-e10-RS4 Firmware: version 1.15.2 only
• ASUS RS500A-e9-PS4 Firmware: version 1.14.1 only
• ASUS RS500A-e9-RS4 Firmware: version 1.14.1 only
• ASUS RS500A-e9 RS4 U Firmware: version 1.14.1 only
• ASUS RS520-e9-RS12-E Firmware: version 1.15.3 only
• ASUS RS520-e9-RS8 Firmware: version 1.15.3 only
• ASUS RS700-e9-RS12 Firmware: version 1.11.5 only
• ASUS RS700-e9-RS4 Firmware: version 1.09 only
• ASUS RS700A-e9-RS12V2 Firmware: version 1.15.1 only
• and 19 more

Published 2021-04-06. Last modified 2026-06-17.