Loading vulnerability…
A vulnerability in the ASUS UX360CA BIOS (through version 303) allows an attacker with ring 0 (kernel-level) privileges to overwrite nearly arbitrary physical memory locations, including System Management RAM (SMRAM). This enables the execution of arbitrary code in System Management Mode (SMM), which operates at a higher privilege level than the OS kernel.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (PoC) Windows kernel driver exploit for CVE-2021-26943, a local privilege escalation vulnerability in ASUS UX360CA BIOS version 303 (and potentially other AMI BIOSes). The exploit leverages vulnerable SMI handlers to gain arbitrary write access to physical memory, including SMRAM, from ring0. The main exploit logic is implemented in 'Demo/Demo/Demo.cpp', which orchestrates the following steps: (1) Locates the System Management Service Table (SMST) in SMRAM by parsing registry entries and scanning physical memory; (2) Overwrites the SmmLocateProtocol function pointer in SMST to point to attacker-controlled shellcode; (3) Installs custom SMM shellcode at a chosen physical address; (4) Triggers an SMI to execute the shellcode in SMM context; (5) Dumps privileged SMM-only information and attempts to patch Hyper-V hypervisor code. The exploit requires kernel privileges and direct access to physical memory, and is only effective on vulnerable BIOS versions. The codebase is structured as a Visual Studio C++ kernel driver project, with clear separation between physical memory access, SMM shellcode logic, and exploitation orchestration. Key fingerprintable endpoints include the use of '\Device\PhysicalMemory' and the registry key '\REGISTRY\MACHINE\HARDWARE\RESOURCEMAP\System Resources\Loader Reserved'.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.