CVE-2022-35899

HIGH

ASUSTeK Aura Ready Game SDK <1.0.0.4 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2022-35899. PoCs published by Angelo Pio Amirante, angelopioamirante.

AI-analyzed exploit summary This exploit describes an unquoted service path vulnerability in Asus GameSDK v1.0.0.4, where an attacker with write privileges to specific directories could place a malicious executable to achieve privilege escalation when the service starts.

Description

There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\ASUS\GameSDK.exe file.

Exploits (2)

exploitdb WRITEUP
by Angelo Pio Amirante · textlocalwindows
https://www.exploit-db.com/exploits/50985

This exploit describes an unquoted service path vulnerability in Asus GameSDK v1.0.0.4, where an attacker with write privileges to specific directories could place a malicious executable to achieve privilege escalation when the service starts.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Asus GameSDK v1.0.0.4
Auth required
Prerequisites: Write access to 'C:\Program Files (x86)\ASUS\' or 'C:\' · Service restart or system reboot
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by angelopioamirante · poc
https://github.com/angelopioamirante/CVE-2022-35899

This repository provides a detailed technical analysis of CVE-2022-35899, an unquoted service path vulnerability in Asus GameSDK. It includes steps to discover the vulnerability, service configuration details, and a clear explanation of the exploit mechanism.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Asus GameSDK v1.0.0.4
Auth required
Prerequisites: Write access to 'C:\Program Files (x86)\ASUS\' or 'C:\' · Local system access
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://www.exploit-db.com/exploits/50985

Scores

CVSS v3 7.8
EPSS 0.0085
EPSS Percentile 53.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-428
Status published
Products (1)
asus/aura_ready_game_software_development_kit 1.0.0.4
Published Jul 21, 2022
Tracked Since Feb 18, 2026