CVE-2022-21933: ASUS VivoMini/Mini PC - improper input validation

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-21 · updated 2026-06-17
Weakness: CWE-20

Description

ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.

Affected products

ASUS Pa90 Firmware: before 1401 — fixed in 1401
ASUS Pb50 Firmware: before 902 — fixed in 902
ASUS Pb60 Firmware: before 1502 — fixed in 1502
ASUS Pb60G Firmware: before 1302 — fixed in 1302
ASUS Pb60S Firmware: before 1302 — fixed in 1302
ASUS Pb60V Firmware: before 1302 — fixed in 1302
ASUS Pb61V Firmware: before 601 — fixed in 601
ASUS Pn30 Firmware: before 320 — fixed in 320
ASUS Pn40 Firmware: before 2201 — fixed in 2201
ASUS Pn60 Firmware: before 808 — fixed in 808
ASUS Ts10 Firmware: before 609 — fixed in 609
ASUS Un65U Firmware: before 618 — fixed in 618
ASUS Vc65-C1 Firmware: before 1302 — fixed in 1302

How to fix

Upgrade to a fixed version: ASUS Pa90 Firmware 1401; ASUS Pb50 Firmware 902; ASUS Pb60 Firmware 1502; ASUS Pb60G Firmware 1302; ASUS Pb60S Firmware 1302; ASUS Pb60V Firmware 1302; ASUS Pb61V Firmware 601; ASUS Pn30 Firmware 320; ASUS Pn40 Firmware 2201; ASUS Pn60 Firmware 808; ASUS Ts10 Firmware 609; ASUS Un65U Firmware 618. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21933 or the next vulnerability affects your stack