title: ASUS BMC's firmware: path traversal - Get Help file function
description: The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: BMC firmware for ASMB9-iKVM
vendor: ASUS
versions:
status: affected, version: 1.11.12
}
{
product: BMC firmware for RS720A-E9-RS24-E
vendor: ASUS
versions:
status: affected, version: 1.10.3
}
{
product: BMC firmware for RS700A-E9-RS4
vendor: ASUS
versions:
status: affected, version: 1.10.0
}
{
product: BMC firmware for RS700-E9-RS4
vendor: ASUS
versions:
status: affected, version: 1.09
}
{
product: BMC firmware for ESC4000 G4X
vendor: ASUS
versions:
status: affected, version: 1.11.6
}
{
product: BMC firmware for RS700-E9-RS12
vendor: ASUS
versions:
status: affected, version: 1.11.5
}
{
product: BMC firmware for RS100-E10-PI2
vendor: ASUS
versions:
status: affected, version: 1.13.6
}
{
product: BMC firmware for RS300-E10-PS4
vendor: ASUS
versions:
status: affected, version: 1.13.6
}
{
product: BMC firmware for RS300-E10-RS4
vendor: ASUS
versions:
status: affected, version: 1.13.6
}
{
product: BMC firmware for RS500A-E9-PS4
vendor: ASUS
versions:
status: affected, version: 1.14.1
}
{
product: BMC firmware for RS500A-E9-RS4
vendor: ASUS
versions:
status: affected, version: 1.14.1
}
{
product: BMC firmware for RS500A-E9 RS4
vendor: ASUS
versions:
status: affected, version: 1.14.1
}
{
product: BMC firmware for E700 G4
vendor: ASUS
versions:
status: affected, version: 1.14.1
}
{
product: BMC firmware for WS C422 PRO/SE
vendor: ASUS
versions:
status: affected, version: 1.14.1
}
{
product: BMC firmware for WS X299 PRO/SE
vendor: ASUS
versions:
status: affected, version: 1.14.1
}
{
product: BMC firmware for Z11PA-U12
vendor: ASUS
versions:
status: affected, version: 1.15.1
}
{
product: BMC firmware for Z11PA-U12/10G-2S
vendor: ASUS
versions:
status: affected, version: 1.15.1
}
{
product: BMC firmware for KNPA-U16
vendor: ASUS
versions:
status: affected, version: 1.13.4
}
{
product: BMC firmware for ESC4000 DHD G4
vendor: ASUS
versions:
status: affected, version: 1.13.7
}
{
product: BMC firmware for ESC4000 G4
vendor: ASUS
versions:
status: affected, version: 1.15.2
}
{
product: BMC firmware for RS720Q-E9-RS24-S
vendor: ASUS
versions:
status: affected, version: 1.15.0
}
{
product: BMC firmware for RS720Q-E9-RS8
vendor: ASUS
versions:
status: affected, version: 1.15.0
}
{
product: BMC firmware for RS720Q-E9-RS8-S
vendor: ASUS
versions:
status: affected, version: 1.15.0
}
{
product: BMC firmware for Z11PA-D8
vendor: ASUS
versions:
status: affected, version: 1.14.1
}
{
product: BMC firmware for Z11PA-D8C
vendor: ASUS
versions:
status: affected, version: 1.14.1
}
{
product: BMC firmware for RS720-E9-RS24-U
vendor: ASUS
versions:
status: affected, version: 1.14.3
}
{
product: BMC firmware for RS720-E9-RS8-G
vendor: ASUS
versions:
status: affected, version: 1.15.2
}
{
product: BMC firmware for RS500-E9-PS4
vendor: ASUS
versions:
status: affected, version: 1.15.4
}
{
product: BMC firmware for Pro E800 G4
vendor: ASUS
versions:
status: affected, version: 1.14.2
}
{
product: BMC firmware for RS500-E9-RS4
vendor: ASUS
versions:
status: affected, version: 1.15.4
}
{
product: BMC firmware for RS500-E9-RS4-U
vendor: ASUS
versions:
status: affected, version: 1.15.4
}
{
product: BMC firmware for RS520-E9-RS12-E
vendor: ASUS
versions:
status: affected, version: 1.15.3
}
{
product: BMC firmware for RS520-E9-RS8
vendor: ASUS
versions:
status: affected, version: 1.15.3
}
{
product: BMC firmware for ESC8000 G4
vendor: ASUS
versions:
status: affected, version: 1.15.4
}
{
product: BMC firmware for ESC8000 G4/10G
vendor: ASUS
versions:
status: affected, version: 1.15.4
}
{
product: BMC firmware for RS720-E9-RS12-E
vendor: ASUS
versions:
status: affected, version: 1.15.2
}
{
product: BMC firmware for WS C621E SAGE
vendor: ASUS
versions:
status: affected, version: 1.15.1
}
{
product: BMC firmware for RS500A-E10-PS4
vendor: ASUS
versions:
status: affected, version: 1.15.2
}
{
product: BMC firmware for RS500A-E10-RS4
vendor: ASUS
versions:
status: affected, version: 1.15.2
}
{
product: BMC firmware for RS700A-E9-RS12V2
vendor: ASUS
versions:
status: affected, version: 1.15.1
}
{
product: BMC firmware for RS700A-E9-RS4V2
vendor: ASUS
versions:
status: affected, version: 1.15.1
}
{
product: BMC firmware for RS720A-E9-RS12V2
vendor: ASUS
versions:
status: affected, version: 1.15.2
}
{
product: BMC firmware for RS720A-E9-RS24V2
vendor: ASUS
versions:
status: affected, version: 1.15.1
}
{
product: BMC firmware for Z11PR-D16
vendor: ASUS
versions:
status: affected, version: 1.15.3
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: update BMC's firmwares to the following versions:
ESC4000 G4X 1.15.6
RS700-E9-RS12 1.15.4
RS100-E10-PI2 1.15.3
RS300-E10-PS4 1.15.3
RS300-E10-RS4 1.15.3
RS500A-E9-PS4 1.14.2
RS500A-E9-RS4 1.14.2
RS500A-E9 RS4 U 1.14.2
E700 G4 1.14.2
WS C422 PRO/SE 1.14.2
WS X299 PRO/SE 1.14.2
Z11PA-U12 1.15.2
KNPA-U16 1.14.5
ESC4000 DHD G4 1.15.2
ESC4000 G4 1.15.6
RS720Q-E9-RS24-S 1.15.1
RS720Q-E9-RS8 1.15.1
RS720Q-E9-RS8-S 1.15.1
Z11PA-D8 1.15.2
Z11PA-D8C 1.15.2
RS720-E9-RS24-U 1.15.5
RS720-E9-RS8-G 1.15.4
RS500-E9-PS4 1.15.5
Pro E800 G4 1.15.2
RS500-E9-RS4 1.15.5
RS500-E9-RS4-U 1.15.5
RS520-E9-RS12-E 1.15.4
RS520-E9-RS8 1.15.4
ESC8000 G4 1.15.5
ESC8000 G4/10G 1.15.5
RS720-E9-RS12-E 1.15.3
WS C621E SAGE 1.15.3
RS500A-E10-PS4 1.15.3
RS500A-E10-RS4 1.15.3
RS700A-E9-RS12V2 1.15.3
RS700A-E9-RS4V2 1.15.3
RS720A-E9-RS12V2 1.15.3
RS720A-E9-RS24V2 1.15.3
Z11PR-D16 1.15.4