Sign-up

ID

VAR-202111-1635


CVE

CVE-2021-41289


TITLE

ASUS P453UJ  Buffer error vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-014922

DESCRIPTION

ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permission, local attackers can modify the BIOS by replacing or filling in the content of the designated Memory DataBuffer, which causing a failure of integrity verification and further resulting in a failure to boot. ASUS P453UJ Exists in a buffer error vulnerability.Information is tampered with and service operation is interrupted (DoS) It may be in a state. ASUS P453UJ is a BIOS firmware of ASUS, Taiwan, China. This results in integrity verification failure and inability to boot. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2021-41289 // JVNDB: JVNDB-2021-014922 // CNVD: CNVD-2021-88203

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-88203

AFFECTED PRODUCTS

vendor:asusmodel:p453uj biosscope:eqversion:311

Trust: 1.0

vendor:asustek computermodel:p453uj biosscope: - version: -

Trust: 0.8

vendor:asustek computermodel:p453uj biosscope:eqversion: -

Trust: 0.8

vendor:asusmodel:p453ujscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2021-88203 // JVNDB: JVNDB-2021-014922 // NVD: CVE-2021-41289

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-41289
value: HIGH

Trust: 1.0

twcert@cert.org.tw: CVE-2021-41289
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-41289
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2021-88203
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202111-1263
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2021-41289
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2021-88203
severity: MEDIUM
baseScore: 5.5
vectorString: AV:L/AC:H/AU:S/C:N/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 1.5
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-41289
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.2
version: 3.1

Trust: 1.0

twcert@cert.org.tw: CVE-2021-41289
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2021-41289
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-88203 // JVNDB: JVNDB-2021-014922 // CNNVD: CNNVD-202111-1263 // NVD: CVE-2021-41289 // NVD: CVE-2021-41289

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:Buffer error (CWE-119) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-014922 // NVD: CVE-2021-41289

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202111-1263

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202111-1263

PATCH

title:P453UJurl:https://www.asus.com/tw/supportonly/p453uj/helpdesk_bios/

Trust: 0.8

title:Patch for ASUS P453UJ buffer overflow vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/298136

Trust: 0.6

title:ASUS P453UJ Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=171326

Trust: 0.6

sources: CNVD: CNVD-2021-88203 // JVNDB: JVNDB-2021-014922 // CNNVD: CNNVD-202111-1263

EXTERNAL IDS

db:NVDid:CVE-2021-41289

Trust: 3.8

db:JVNDBid:JVNDB-2021-014922

Trust: 0.8

db:CNVDid:CNVD-2021-88203

Trust: 0.6

db:CNNVDid:CNNVD-202111-1263

Trust: 0.6

sources: CNVD: CNVD-2021-88203 // JVNDB: JVNDB-2021-014922 // CNNVD: CNNVD-202111-1263 // NVD: CVE-2021-41289

REFERENCES

url:https://www.twcert.org.tw/tw/cp-132-5284-35790-1.html

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-41289

Trust: 2.0

url:https://www.asus.com/tw/supportonly/p453uj/helpdesk_bios/

Trust: 1.6

sources: CNVD: CNVD-2021-88203 // JVNDB: JVNDB-2021-014922 // CNNVD: CNNVD-202111-1263 // NVD: CVE-2021-41289

SOURCES

db:CNVDid:CNVD-2021-88203
db:JVNDBid:JVNDB-2021-014922
db:CNNVDid:CNNVD-202111-1263
db:NVDid:CVE-2021-41289

LAST UPDATE DATE

2024-11-23T23:01:00.674000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-88203date:2021-11-17T00:00:00
db:JVNDBid:JVNDB-2021-014922date:2022-11-02T01:12:00
db:CNNVDid:CNNVD-202111-1263date:2021-11-26T00:00:00
db:NVDid:CVE-2021-41289date:2024-11-21T06:25:58.370

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-88203date:2021-11-17T00:00:00
db:JVNDBid:JVNDB-2021-014922date:2022-11-02T00:00:00
db:CNNVDid:CNNVD-202111-1263date:2021-11-15T00:00:00
db:NVDid:CVE-2021-41289date:2021-11-15T10:15:07.697