CVE-2022-21933

MEDIUM

ASUS VivoMini/Mini PC Firmware - Arbitrary Code Execution via SMI Memory Modification

Title source: llm
STIX 2.1

Description

ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-5547-34bc4-1.html

Scores

CVSS v3 6.7
EPSS 0.0011
EPSS Percentile 28.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20 CWE-787
Status published
Products (13)
asus/pa90_firmware < 1401
asus/pb50_firmware < 902
asus/pb60_firmware < 1502
asus/pb60g_firmware < 1302
asus/pb60s_firmware < 1302
asus/pb60v_firmware < 1302
asus/pb61v_firmware < 601
asus/pn30_firmware < 320
asus/pn40_firmware < 2201
asus/pn60_firmware < 808
... and 3 more
Published Jan 21, 2022
Tracked Since Feb 18, 2026