CVE-2021-22887

Severity: low (CVSS 2.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-16 · updated 2026-06-17
Weakness: CWE-506

Description

A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.

Affected products

Pulsesecure Psa-5000 Firmware: all versions
Pulsesecure Psa-7000 Firmware: all versions
Supermicro X10Sl7-F Firmware: before 3.4 — fixed in 3.4
Supermicro X10Sla-F Firmware: before 3.4 — fixed in 3.4
Supermicro X10Slh-F Firmware: before 3.4 — fixed in 3.4
Supermicro X10Sll+F Firmware: before 3.4 — fixed in 3.4
Supermicro X10Sll-F Firmware: before 3.4 — fixed in 3.4
Supermicro X10Sll-S Firmware: before 3.4 — fixed in 3.4
Supermicro X10Sll-Sf Firmware: before 3.4 — fixed in 3.4
Supermicro X10Slm+-F Firmware: before 3.4 — fixed in 3.4
Supermicro X10Slm+Ln4F Firmware: before 3.4 — fixed in 3.4
Supermicro X10Slm-F Firmware: before 3.4 — fixed in 3.4

How to fix

Upgrade to a fixed version: Supermicro X10Sl7-F Firmware 3.4; Supermicro X10Sla-F Firmware 3.4; Supermicro X10Slh-F Firmware 3.4; Supermicro X10Sll+F Firmware 3.4; Supermicro X10Sll-F Firmware 3.4; Supermicro X10Sll-S Firmware 3.4; Supermicro X10Sll-Sf Firmware 3.4; Supermicro X10Slm+-F Firmware 3.4; Supermicro X10Slm+Ln4F Firmware 3.4; Supermicro X10Slm-F Firmware 3.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22887 or the next vulnerability affects your stack