CVE-2021-22887: A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of...

Summary

A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.

What to do

Update supermicro x10slh-f_firmware to version 3.4 or later.
Update supermicro x10sll-f_firmware to version 3.4 or later.
Update supermicro x10slm-f_firmware to version 3.4 or later.
Update supermicro x10sll\+f_firmware to version 3.4 or later.
Update supermicro x10slm\+-f_firmware to version 3.4 or later.
Update supermicro x10slm\+ln4f_firmware to version 3.4 or later.
Update supermicro x10sla-f_firmware to version 3.4 or later.
Update supermicro x10sl7-f_firmware to version 3.4 or later.
Update supermicro x10sll-s_firmware to version 3.4 or later.
Update supermicro x10sll-sf_firmware to version 3.4 or later.

Affected software

Vendor	Product	Affected versions
pulsesecure	psa-5000_firmware	All versions `cpe:2.3:o:pulsesecure:psa-5000_firmware:-:::::::*`
pulsesecure	psa-7000_firmware	All versions `cpe:2.3:o:pulsesecure:psa-7000_firmware:-:::::::*`
supermicro	x10slh-f_firmware	< 3.4 `cpe:2.3:o:supermicro:x10slh-f_firmware::::::::`
supermicro	x10sll-f_firmware	< 3.4 `cpe:2.3:o:supermicro:x10sll-f_firmware::::::::`
supermicro	x10slm-f_firmware	< 3.4 `cpe:2.3:o:supermicro:x10slm-f_firmware::::::::`
supermicro	x10sll\+f_firmware	< 3.4 `cpe:2.3:o:supermicro:x10sll\+f_firmware::::::::`
supermicro	x10slm\+-f_firmware	< 3.4 `cpe:2.3:o:supermicro:x10slm\+-f_firmware::::::::`
supermicro	x10slm\+ln4f_firmware	< 3.4 `cpe:2.3:o:supermicro:x10slm\+ln4f_firmware::::::::`
supermicro	x10sla-f_firmware	< 3.4 `cpe:2.3:o:supermicro:x10sla-f_firmware::::::::`
supermicro	x10sl7-f_firmware	< 3.4 `cpe:2.3:o:supermicro:x10sl7-f_firmware::::::::`
supermicro	x10sll-s_firmware	< 3.4 `cpe:2.3:o:supermicro:x10sll-s_firmware::::::::`
supermicro	x10sll-sf_firmware	< 3.4 `cpe:2.3:o:supermicro:x10sll-sf_firmware::::::::`

Original advisory text

A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of...

A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.

References

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44712 Patch Vendor Advisory
https://www.supermicro.com/en/support/security/Trickbot Third Party Advisory