CVE-2022-21933
ASUS VivoMini/Mini PC - improper input validation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1302, 1401, 902, 1502, 601, and 5 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.
Timeline
- CVE published
- Record last updated
Affected versions
- ASUS VC65-C1
fixed in 1302
- ASUS PB60V
fixed in 1302
- ASUS PB60G
fixed in 1302
- ASUS PB60S
fixed in 1302
- ASUS PA90
fixed in 1401
- ASUS PB50
fixed in 902
- ASUS PB60
fixed in 1502
- ASUS PB61V
fixed in 601
- ASUS TS10
fixed in 609
- ASUS PN40
fixed in 2201
- ASUS PN60
fixed in 808
- ASUS PN30
fixed in 320
- ASUS UN65U
fixed in 618