CVE-2019-18216

{
  "id": "CVE-2019-18216",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-10-20T16:15:10.263",
  "references": [
    {
      "url": "https://blog.modpr0.be/2019/10/18/asus-rog-bios-reset-on-lost-battery-power/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://blog.modpr0.be/2019/10/18/asus-rog-bios-reset-on-lost-battery-power/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access can exhaust the main battery to reset the BIOS configuration, and then achieve direct access to the hard drive by booting a live USB OS without disassembling the laptop. NOTE: the vendor has apparently indicated that this is \"normal\" and use of the same battery for the BIOS and the overall system is a \"new design.\" However, the vendor apparently plans to \"improve\" this an unspecified later time"
    },
    {
      "lang": "es",
      "value": "** EN DISPUTA ** El diseño de la configuración del BIOS en los ordenadores portátiles ASUS ROG Zephyrus M GM501GS con BIOS versión 313 se basa en la batería principal en lugar de usar una batería CMOS, lo que reduce el valor de un mecanismo de protección en el que se prohíbe el arranque desde un dispositivo USB. Los atacantes con acceso físico a la computadora portátil pueden agotar la batería principal para restablecer la configuración del BIOS, y luego lograr acceso directo al disco duro iniciando un sistema operativo USB en vivo sin desensamblar el ordenador portátil. NOTA: el proveedor ha indicado aparentemente que esto es \"normal\" y que el uso de la misma batería para el BIOS y el sistema en general es un \"new design\". Sin embargo, el proveedor planea aparentemente \"improve\" esto un tiempo posterior no especificado."
    }
  ],
  "lastModified": "2026-06-17T02:24:30.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:asus:rog_zephyrus_m_gm501gs_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0C4A9B2-B71E-4140-B46D-2DFF688937D1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:asus:rog_zephyrus_m_gm501gs:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1CA22FDF-4D58-46E5-AD00-24E479A25B43"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}