---
id: "CVE-2021-27562"
kind: "vulnerability"
aliases: ["CVE-2021-27562"]
title: "Arm Trusted Firmware: Arm Trusted Firmware Out-of-Bounds Write Vulnerability"
severity: "high"
cvss: 5.5
epss: 0.0306
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Arm Trusted Firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["arm", "embedded", "exploited", "infrastructure", "trusted-firmware", "yealink-device-management"]
not_affected_if: ["unknown"]
published_at: "2021-05-25T19:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27562", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-27562", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27562", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Arm Trusted Firmware: Arm Trusted Firmware Out-of-Bounds Write Vulnerability

Arm Trusted Firmware has an out-of-bounds write that lets code running in the non-secure world halt the system, overwrite secure data, or print secure data through secure function calls. CISA lists it as actively exploited, and the description says it affects Yealink Device Management servers.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Arm Trusted Firmware affected ? fixed ?

## Fix

Apply updates per vendor instructions; the sources do not name a fixed version.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27562
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-27562
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-27562

## From the sources

Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_