{"id":"CVE-2021-27562","kind":"vulnerability","aliases":["CVE-2021-27562"],"related":[],"title":"Arm Trusted Firmware: Arm Trusted Firmware Out-of-Bounds Write Vulnerability","description":"Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Arm Trusted Firmware has an out-of-bounds write that lets code running in the non-secure world halt the system, overwrite secure data, or print secure data through secure function calls. CISA lists it as actively exploited, and the description says it affects Yealink Device Management servers.","severity":"high","cvss":5.5,"epss":0.0306,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Arm Trusted Firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["arm","embedded","exploited","infrastructure","trusted-firmware","yealink-device-management"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply updates per vendor instructions; the sources do not name a fixed version.","status":"open","published_at":"2021-05-25T19:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:43:30+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:43:30Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions; the sources do not name a fixed version.","reach":"local","impact":"high","summary":"Arm Trusted Firmware has an out-of-bounds write that lets code running in the non-secure world halt the system, overwrite secure data, or print secure data through secure function calls. CISA lists it as actively exploited, and the description says it affects Yealink Device Management servers.","category":"infrastructure","who_cares":["arm","trusted-firmware","yealink-device-management","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker overwrites secure-world data or reads secrets, possibly halting the device.","analyst_note":"Find the vendor advisory and fixed Arm Trusted Firmware version, and confirm which Yealink products embed it; the CISA KEV entry and NVD record are the starting points.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000476,"input_tokens":2900,"output_tokens":372,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the vendor advisory and fixed Arm Trusted Firmware version, and confirm which Yealink products embed it; the CISA KEV entry and NVD record are the starting points.","search":"'-2021':14A,17A '-27562':15A,18A 'action':137C 'activ':71B 'affect':78B,130C 'allow':94C 'appli':138C 'arm':1A,4A,19A,22B,33B,83C 'bound':10A,41B,91C 'call':66B,115C 'cisa':67B,135C 'code':45B 'contain':86C 'cve':13A,16A 'data':58B,62B,108C,113C 'descript':75B 'devic':31B,80B,132C 'embed':23B 'environ':124C 'exploit':24B,72B 'firmwar':3A,6A,28B,35B,85C 'firmware':21A 'function':65B,117C 'halt':53B,105C 'handler':126C 'infrastructur':25B 'instruct':142C 'let':44B 'list':68B 'manag':32B,81B,133C 'mode':127C 'non':50B,97C,121C 'non-secur':49B,96C,120C 'ns':99C 'nspe':125C 'out-of-bound':7A,38B,88C 'overwrit':56B,106C 'per':140C 'print':60B,110C 'process':123C 'requir':136C 'run':46B 'say':76B 'secur':51B,57B,61B,64B,98C,107C,112C,116C,122C 'server':82B,134C 'system':55B,104C 'trigger':102C 'trust':2A,5A,27B,34B,84C 'trusted':20A 'trusted-firmwar':26B 'updat':139C 'vendor':141C 'vulner':12A,93C,129C 'world':52B,100C 'write':11A,42B,92C 'yealink':30B,79B,131C 'yealink-device-manag':29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-25T19:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-27562","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27562","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T20:35:38+00:00","note":null},{"source":"epss","external_id":"CVE-2021-27562","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27562","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-27562","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27562","severity":null,"published_at":"2021-05-25T19:15:07+00:00","modified_at":"2026-06-17T03:45:08+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}