CVE-2022-21933: ASUS PA90 Firmware

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.

Affected products

• ASUS PA90 Firmware: before 1401 (fixed in 1401)
• ASUS PB50 Firmware: before 902 (fixed in 902)
• ASUS PB60 Firmware: before 1502 (fixed in 1502)
• ASUS PB60G Firmware: before 1302 (fixed in 1302)
• ASUS PB60S Firmware: before 1302 (fixed in 1302)
• ASUS PB60V Firmware: before 1302 (fixed in 1302)
• ASUS PB61V Firmware: before 601 (fixed in 601)
• ASUS PN30 Firmware: before 320 (fixed in 320)
• ASUS PN40 Firmware: before 2201 (fixed in 2201)
• ASUS PN60 Firmware: before 808 (fixed in 808)
• ASUS TS10 Firmware: before 609 (fixed in 609)
• ASUS UN65U Firmware: before 618 (fixed in 618)
• ASUS VC65-c1 Firmware: before 1302 (fixed in 1302)

Published 2022-01-21. Last modified 2026-06-17.