CVE-2022-21933 in VivoMini

Riassunto

di MITRE • 21/01/2022

ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsabile: TWCERT/CC
• Prenotare: 14/12/2021
• Divulgazione: 21/01/2022
• Moderazione: accettato
• Voce: VDB-191358
• CPE: pronto
• CWE: CWE-20 (confermato)
• CVSS: 6.7 (CNA)
• EPSS: 0.00280
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2022-21933
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-21933
• CVE Details: https://www.cvedetails.com/cve/CVE-2022-21933/