ASUS VivoMini/Mini PC - improper input validation

published 2022-01-21 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-27089

cvss: 6.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits: 0; none known

ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.

Patch / fix

fixed in 13

ASUS VC65-C1 1302
ASUS PB60V 1302
ASUS PB60G 1302
ASUS PB60S 1302
ASUS PA90 1401
ASUS PB50 902
ASUS PB60 1502
ASUS PB61V 601
ASUS TS10 609
ASUS PN40 2201
ASUS PN60 808
ASUS PN30 320
ASUS UN65U 618

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

ASUS VC65-C1
ASUS PB60V
ASUS PB60G
ASUS PB60S
ASUS PA90
ASUS PB50
ASUS PB60
ASUS PB61V
ASUS TS10
ASUS PN40
ASUS PN60
ASUS PN30
ASUS UN65U

Classification

Weakness

CWE-20 Improper Input Validation
CWE-787 Out-of-bounds Write

References

twcert.org.tw /tw/cp-132-5547-34bc4-1.html
third-party-advisory

Sources

CVE List CVE-2022-21933
NVD CVE-2022-21933

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary