CVE-2021-41289

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permission, local attackers can modify the BIOS by replacing or filling in the content of the designated Memory DataBuffer, which causing a failure of integrity verification and further resulting in a failure to boot.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
ASUS	P453UJ BIOS	311

References

https://www.asus.com/tw/supportonly/P453UJ/HelpDesk_BIOS/Vendor Advisory
https://www.twcert.org.tw/tw/cp-132-5284-35790-1.htmlThird Party Advisory
https://www.asus.com/tw/supportonly/P453UJ/HelpDesk_BIOS/Vendor Advisory
https://www.twcert.org.tw/tw/cp-132-5284-35790-1.htmlThird Party Advisory

Timeline

Published: Nov 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-41299.8Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano r CVE-2021-412909.8ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attack CVE-2021-412917.5ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated CVE-2021-412929.1ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely b CVE-2021-412937.5ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unau CVE-2021-412949.1ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthe CVE-2021-412958.8ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a mal CVE-2021-412969.8ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full CVE-2021-412978.8ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing CVE-2021-412988.8ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects bas CVE-2021-412999.8ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administra CVE-2021-41308.8snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)