LiveActive security incident?Get immediate response
CVE Record

CVE-2021-41289: ASUS P453UJ - Improper Restriction of Operations within the Bounds of a Memory Buffer

ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permission, local attackers can modify the BIOS by replacing or filling in the content of the designated Memory DataBuffer, which causing a failure of integrity verification and further resulting in a failure to boot.

MediumCVSS 6.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw affects ASUS P453UJ BIOS version 311. Someone with local user access could corrupt BIOS-related memory data, breaking integrity checks and potentially preventing the laptop from booting. The risk is disruptive rather than remotely scalable based on the supplied sources.

Executive priority

Handle as a targeted firmware availability risk, not an internet-wide emergency. If affected laptops exist in the fleet, prioritize vendor-guided remediation because successful abuse could make devices unable to boot and require hands-on recovery.

Technical view

CVE-2021-41289 is a CWE-119 memory buffer bounds issue in ASUS P453UJ BIOS 311. A local attacker with low privileges may modify the designated Memory DataBuffer, causing integrity verification failure and possible boot failure. CVSS 3.1 score is 6.3 with local attack vector and high complexity.

Likely exposure

Exposure appears limited to ASUS P453UJ systems running BIOS version 311. The supplied sources do not identify other ASUS models, BIOS versions, or remote attack paths.

Exploitation context

The source bundle does not show KEV listing or active exploitation evidence. Exploitation requires local access, low privileges, and high attack complexity, with likely impact to integrity and availability.

Researcher notes

Evidence is narrow: one affected product/version, local vector, no supplied exploit status, and no explicit fixed version in the bundle. Avoid broad ASUS exposure claims unless confirmed by vendor material.

Mitigation direction

  • Inventory ASUS P453UJ devices and record BIOS versions.
  • Check ASUS and TWCERT guidance for BIOS update or recovery instructions.
  • Prioritize remediation for shared, kiosk, lab, or high-risk user-accessible laptops.
  • Restrict unnecessary local user access where affected devices remain in service.

Validation and detection

  • Confirm whether any fleet device is ASUS P453UJ with BIOS 311.
  • Review vendor support pages for applicable BIOS guidance before changes.
  • Verify boot recovery procedures exist for affected devices.
  • Monitor affected systems for unexplained BIOS integrity or boot failures.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-119: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-41289 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.3CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H15.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.3Medium
CVSS 3.1 vector shape for CVE-2021-41289Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ASUSP453UJ BIOS311Listed
Weakness

CWE details

CWE-119

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-119 · source CWE mapping

Improper Restriction of Operations within the Bounds of a Memory Buffer

Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs