Vulnerability · Published Jan 21, 2022 · Assigned by twcert
CVE-2022-21933ASUS VivoMini/Mini PC - improper input validation
Medium 6.7
In plain English
A medium-severity improper input validation in PA90 from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ASUS | VC65-C1 | unspecified – before 1302 |
| ASUS | PB60V | unspecified – before 1302 |
| ASUS | PB60G | unspecified – before 1302 |
| ASUS | PB60S | unspecified – before 1302 |
| ASUS | PA90 | unspecified – before 1401 |
| ASUS | PB50 | unspecified – before 902 |
| ASUS | PB60 | unspecified – before 1502 |
| ASUS | PB61V | unspecified – before 601 |
| ASUS | TS10 | unspecified – before 609 |
| ASUS | PN40 | unspecified – before 2201 |
| ASUS | PN60 | unspecified – before 808 |
| ASUS | PN30 | unspecified – before 320 |
| ASUS | UN65U | unspecified – before 618 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-5547-34bc4-1.html x_refsource_MISC