ASUS Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with ASUS products.

Products

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll Untrusted Pointer Dereference Privilege Escalation

Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation. Refer to the '  Security Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin   ' section on the ASUS Security Advisory for more information.

CWE-822Aug 11, 2026
CVSS8.4v4.0EPSS0.114%PoCs0SignalsSTIX

ASUS Armoury Crate Race Condition Leading to Local Privilege Escalation

Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Security Advisory for more information.

CWE-362Jul 30, 2026
CVSS7.3v4.0EPSS0.087%PoCs0SignalsSTIX

ASUS AURA SYNC Exposed IOCTL with Insufficient Access Control

**UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.

CWE-782Jul 17, 2026
CVSS7.3v4.0EPSS0.09%PoCs0SignalsSTIX

ASUS Router Improper Certificate Validation and Integrity Check Leading to Remote Code Execution

An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the '  Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.

CWE-295CWE-354Jul 15, 2026
CVSS9.5v4.0EPSS0.142%PoCs0SignalsSTIX

ASUS System Control Interface v3, System Control Interface, and Business Manager Untrusted Pointer Dereference

Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the driver, bypassing OS-enforced memory protections. Refer to the '  Security Update for ASUS System Control Interface  ' section on the ASUS Security Advisory for more information.

CWE-822Jul 15, 2026
CVSS8.4v4.0EPSS0.135%PoCs0SignalsSTIX

ASUS System Control Interface v3, System Control Interface, and Business Manager Out-of-bounds Read

Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request that bypasses the validation. Refer to the ' Security Update for ASUS System Control Interface  ' section on the ASUS Security Advisory for more information.

CWE-125Jul 15, 2026
CVSS5.6v4.0EPSS0.112%PoCs0SignalsSTIX

ASUS bsitf.sys Kernel Driver IOCTL 0x222808 Kernel Memory Mapping to Usermode

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the '  Security Update for ASUS System Control Interface  ' section on the ASUS Security Advisory for more information.

CWE-226CWE-770Jul 15, 2026
CVSS8.2v4.0EPSS0.307%PoCs1SignalsSTIX

ASUS Aura Wallpaper Service Arbitrary File Operations via Path Traversal

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On specific models , this can also cause a single feature to become unavailable . Refer to the ' Security Update for Aura Wallpaper Service ' section on the ASUS Security Advisory for more information.

CWE-73CWE-923Jul 15, 2026
CVSS8.5v4.0EPSS0.1%PoCs0SignalsSTIX

ASUS GameSDK Permissive Cross-domain Security Policy with Untrusted Domains

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in information disclosure or data tampering, may cause GameSDK to become unavailable, and may also enable access to the victim’s information on other services. Refer to the ' Security Update for ASUS GameSDK  '…

CWE-942Jul 15, 2026
CVSS7.2v4.0EPSS0.3%PoCs0SignalsSTIX

ASUS Router Web Management Interface SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the '  Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CWE-89Jul 15, 2026
CVSS5.9v4.0EPSS0.368%PoCs0SignalsSTIX

ASUS AI Suite 3 Driver Improper Input Validation Leading to Privilege Escalation

** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memory regions via crafted IOCTL requests, leading to privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.

CWE-1284Jul 3, 2026
CVSS8.5v4.0EPSS0.103%PoCs0SignalsSTIX

ASUS AI Suite 3 Driver Improper Input Validation Leading to Privilege Escalation

** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.

CWE-1284Jul 3, 2026
CVSS7.3v4.0EPSS0.096%PoCs0SignalsSTIX

ASUS Business Manager External Control of File Name or Path Leading to Local Privilege Escalation

External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.

CWE-73Jul 3, 2026
CVSS8.5v4.0EPSS0.124%PoCs0SignalsSTIX

ASUS Router App Improper Export of Android Application Components

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information.

CWE-926Jul 3, 2026
CVSS6.0v4.0EPSS0.119%PoCs0SignalsSTIX

ASUS Armoury Crate Permissive List of Inputs Local Arbitrary Memory Read/Write

A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

CWE-183Jun 22, 2026
CVSS7.1v4.0EPSS0.279%PoCs0SignalsSTIX

ASUS System Control Interface Incorrect Permission Assignment Local Privilege Escalation

An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary code via a crafted RPC call that bypass the validation mechanism. Refer to the 'Security Update for ASUS System Control Interface' section on the ASUS Security Advisory for more information.

CWE-732May 29, 2026
CVSS7.3v4.0EPSS0.135%PoCs0SignalsSTIX

ASUS Armoury Crate Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthorized read and write access to physical memory.Refer to the '  Security Update for Armoury Crate App   ' section on the ASUS Security Advisory for more information.

CWE-732May 29, 2026
CVSS7.3v4.0EPSS0.09%PoCs0SignalsSTIX

Out-of-Bounds Read in ASUS System Control Interface IOCTL Handler

An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) via a read size that exceeds the buffer size.Refer to the ' Security Update for MyASUS ' section on the ASUS Security Advisory for more information.

CWE-125May 8, 2026
CVSS6.8v4.0EPSS0.137%PoCs0SignalsSTIX

ASUS AsusPTPFilter Exposed IOCTL with Insufficient Access Control

An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms and obtain restricted touchpad information or render the touchpad unusable via crafted IOCTL requests.Refer to the ' Security Update for ASUS Precision Touchpad ' section on the ASUS Security Advisory for more information.

CWE-782May 8, 2026
CVSS2.0v4.0EPSS0.092%PoCs0SignalsSTIX

ASUS Member Center TOCTOU Race Condition Leading to Privilege Escalation

A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download, and subsequently executed with administrative privileges upon user consent. Refer to the 'Security Update for ASUS Member Center' section on the AS…

CWE-367CWE-494Apr 16, 2026
CVSS5.4v4.0EPSS0.074%PoCs0SignalsSTIX

ASUS DriverHub TOCTOU Privilege Escalation

An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protection of required execution resources during the validation phase, permitting a local user to make unprivileged modifications. This allows the altered resource to pass system checks and be executed with elevated privileges upon a user-initiated update. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory fo…

CWE-367Apr 16, 2026
CVSS5.4v4.0EPSS0.139%PoCs0SignalsSTIX

ASUS Router Web Management Interface OS Command Injection

An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CWE-78Mar 26, 2026
CVSS8.6v4.0EPSS0.899%PoCs0SignalsSTIX

ASUS Business System Control Interface Driver Out-of-Bounds Read

An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially crafted IOCTL  request, potentially leading to a disclosure of kernel information or a system crash. Refer to the "Security Update for ASUS  Business System Control Interface" section on the ASUS Security Advisory for more information.

CWE-125Mar 12, 2026
CVSS6.9v4.0EPSS0.108%PoCs0SignalsSTIX

ASUS ROG Peripheral Driver Installation Insufficient Integrity Verification Privilege Escalation

An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race condition where the legitimate installer is substituted with an unexpected payload immediately after download, resulting in arbitrary code execution. Refer to the "Security Update for ASUS ROG peripheral driver" section on the AS…

CWE-494Mar 12, 2026
CVSS5.4v4.0EPSS0.13%PoCs0SignalsSTIX

ASUS Business System Control Interface Incorrect Permission Assignment Leading to Information Disclosure

An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially crafted IOCTL request, potentially leading to unauthorized access to sensitive hardware resources and kernel information disclosure. Refer to the "ASUS Business System Control Interface" section on the ASUS Security Advisory for more information.

CWE-732Mar 12, 2026
CVSS6.8v4.0EPSS0.099%PoCs0SignalsSTIX