https://vulnogram.org/ Most recent CVEs assigned by ASUSTeK Computer Incorporation (asus). https://vulnogram.org/seaview/icons/asus.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-75753 https://vulnogram.org/CVE-2026-75753 Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As… Medium Tue, 20 Oct 2026 02:00:27 GMT https://vulnogram.org/CVE-2026-17518 https://vulnogram.org/CVE-2026-17518 Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Sec… High Tue, 20 Oct 2026 02:00:16 GMT https://vulnogram.org/CVE-2026-102438 https://vulnogram.org/CVE-2026-102438 An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the… High Tue, 20 Oct 2026 02:00:05 GMT https://vulnogram.org/CVE-2026-14911 https://vulnogram.org/CVE-2026-14911 Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user v… Critical Network Exploitable Wed, 07 Oct 2026 02:13:30 GMT https://vulnogram.org/CVE-2026-19396 https://vulnogram.org/CVE-2026-19396 A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values… High Wed, 07 Oct 2026 02:07:33 GMT https://vulnogram.org/CVE-2026-19386 https://vulnogram.org/CVE-2026-19386 A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmwa… Critical Wed, 07 Oct 2026 02:05:31 GMT https://vulnogram.org/CVE-2026-16528 https://vulnogram.org/CVE-2026-16528 Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for… High Wed, 07 Oct 2026 02:02:43 GMT https://vulnogram.org/CVE-2026-13313 https://vulnogram.org/CVE-2026-13313 An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges an… High Thu, 01 Oct 2026 02:00:57 GMT https://vulnogram.org/CVE-2026-14157 https://vulnogram.org/CVE-2026-14157 Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface. Critical Thu, 01 Oct 2026 02:00:34 GMT https://vulnogram.org/CVE-2026-93495 https://vulnogram.org/CVE-2026-93495 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the ' Security Update for Multiple ASUS Motherboards ' section on the ASUS… High Thu, 01 Oct 2026 02:00:12 GMT https://vulnogram.org/CVE-2026-19397 https://vulnogram.org/CVE-2026-19397 Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Upda… High Tue, 08 Sep 2026 02:04:26 GMT https://vulnogram.org/CVE-2026-12962 https://vulnogram.org/CVE-2026-12962 A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application… Medium Network Exploitable Tue, 08 Sep 2026 02:03:58 GMT https://vulnogram.org/CVE-2026-18023 https://vulnogram.org/CVE-2026-18023 Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mecha… Medium Tue, 08 Sep 2026 02:03:38 GMT https://vulnogram.org/CVE-2026-16003 https://vulnogram.org/CVE-2026-16003 Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the ' Security Upd… Low Tue, 08 Sep 2026 02:03:17 GMT https://vulnogram.org/CVE-2026-16004 https://vulnogram.org/CVE-2026-16004 Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for… Medium Tue, 08 Sep 2026 02:02:49 GMT https://vulnogram.org/CVE-2026-16005 https://vulnogram.org/CVE-2026-16005 Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (BSOD).Refer t… Medium Tue, 08 Sep 2026 02:02:23 GMT https://vulnogram.org/CVE-2026-16006 https://vulnogram.org/CVE-2026-16006 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing furthe… Medium Tue, 08 Sep 2026 02:01:59 GMT https://vulnogram.org/CVE-2026-75808 https://vulnogram.org/CVE-2026-75808 Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exhaustion by bypassing driver authentication and allocating an unrestricted amount of memory.… Medium Tue, 08 Sep 2026 02:01:34 GMT https://vulnogram.org/CVE-2026-75809 https://vulnogram.org/CVE-2026-75809 Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration spa… Medium Tue, 08 Sep 2026 02:01:14 GMT https://vulnogram.org/CVE-2026-75810 https://vulnogram.org/CVE-2026-75810 Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing driver authentication and sending requests to trigger system management interrupts (SMIs). Repeatedly triggering SMI may lead to… Medium Tue, 08 Sep 2026 02:00:45 GMT https://vulnogram.org/CVE-2026-75811 https://vulnogram.org/CVE-2026-75811 Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potentially cause hardware damage by bypassing driver authentication and accessing critical model… Medium Tue, 08 Sep 2026 02:00:06 GMT https://vulnogram.org/CVE-2026-75754 https://vulnogram.org/CVE-2026-75754 Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable… Critical Network Exploitable Fri, 04 Sep 2026 02:08:54 GMT https://vulnogram.org/CVE-2026-19398 https://vulnogram.org/CVE-2026-19398 An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corruption via a crafted software SMI (SW SMI) request with an oversized length value.Refer to the… Medium Thu, 27 Aug 2026 02:00:16 GMT https://vulnogram.org/CVE-2026-8917 https://vulnogram.org/CVE-2026-8917 Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation. Refer to the… High Tue, 11 Aug 2026 02:00:08 GMT https://vulnogram.org/CVE-2026-16727 https://vulnogram.org/CVE-2026-16727 Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update fo… High Thu, 30 Jul 2026 02:00:07 GMT https://vulnogram.org/CVE-2019-25764 https://vulnogram.org/CVE-2019-25764 **UNSUPPORTED WHEN ASSIGNED** Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation. Refer to the 'End-of-Lif… High Fri, 17 Jul 2026 06:00:10 GMT https://vulnogram.org/CVE-2026-13385 https://vulnogram.org/CVE-2026-13385 An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to th… Critical Network Exploitable Wed, 15 Jul 2026 02:01:46 GMT https://vulnogram.org/CVE-2026-15029 https://vulnogram.org/CVE-2026-15029 Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the… High Wed, 15 Jul 2026 02:01:33 GMT https://vulnogram.org/CVE-2026-15030 https://vulnogram.org/CVE-2026-15030 Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request that bypas… Medium Wed, 15 Jul 2026 02:01:24 GMT https://vulnogram.org/CVE-2026-13585 https://vulnogram.org/CVE-2026-13585 Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information v… High Wed, 15 Jul 2026 02:01:10 GMT https://vulnogram.org/CVE-2026-8920 https://vulnogram.org/CVE-2026-8920 Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and by… High Wed, 15 Jul 2026 02:00:56 GMT https://vulnogram.org/CVE-2026-8919 https://vulnogram.org/CVE-2026-8919 Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s… High Network Exploitable Wed, 15 Jul 2026 02:00:46 GMT https://vulnogram.org/CVE-2026-11851 https://vulnogram.org/CVE-2026-11851 Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypa… Medium Wed, 15 Jul 2026 02:00:26 GMT https://vulnogram.org/CVE-2022-4989 https://vulnogram.org/CVE-2022-4989 ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memory regions via crafted IOCTL requests, leading to privilege escalation. Refer to the 'End-of… High Fri, 03 Jul 2026 02:01:02 GMT https://vulnogram.org/CVE-2022-4990 https://vulnogram.org/CVE-2022-4990 ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to privilege es… High Fri, 03 Jul 2026 02:00:47 GMT https://vulnogram.org/CVE-2026-8921 https://vulnogram.org/CVE-2026-8921 External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the AS… High Fri, 03 Jul 2026 02:00:34 GMT https://vulnogram.org/CVE-2026-12960 https://vulnogram.org/CVE-2026-12960 An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update fo… Medium Fri, 03 Jul 2026 02:00:14 GMT https://vulnogram.org/CVE-2026-8918 https://vulnogram.org/CVE-2026-8918 A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the ' Security Update for Armoury C… High Mon, 22 Jun 2026 02:00:12 GMT https://vulnogram.org/CVE-2026-7480 https://vulnogram.org/CVE-2026-7480 An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary code via a crafted RPC call that bypass the validation mechanism. Refer… High Fri, 29 May 2026 02:06:43 GMT https://vulnogram.org/CVE-2026-8070 https://vulnogram.org/CVE-2026-8070 Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthorized read and write access to physical memory.Refer to the ' Security Update for Armoury Cr… High Fri, 29 May 2026 02:00:39 GMT https://vulnogram.org/CVE-2026-3508 https://vulnogram.org/CVE-2026-3508 An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) via a read size that exceeds the buffer size.Refer to the ' Security Update for MyASUS ' section on the ASUS Se… Medium Fri, 08 May 2026 02:00:53 GMT https://vulnogram.org/CVE-2026-6737 https://vulnogram.org/CVE-2026-6737 An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms and obtain restricted touchpad information or render the touchpad unusable via crafted IOCTL requests.Refer to t… Low Fri, 08 May 2026 02:00:26 GMT https://vulnogram.org/CVE-2026-3428 https://vulnogram.org/CVE-2026-3428 A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the updat… Medium Thu, 16 Apr 2026 02:02:41 GMT https://vulnogram.org/CVE-2026-1880 https://vulnogram.org/CVE-2026-1880 An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protection of required execution resources during the validation phase, permitting a local user to… Medium Thu, 16 Apr 2026 02:00:36 GMT https://vulnogram.org/CVE-2025-15101 https://vulnogram.org/CVE-2025-15101 An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router… High Thu, 26 Mar 2026 02:01:26 GMT https://vulnogram.org/CVE-2025-15038 https://vulnogram.org/CVE-2025-15038 An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially crafted IOCTL request, potentially leading to a disclosure of kerne… Medium Thu, 12 Mar 2026 02:03:19 GMT https://vulnogram.org/CVE-2026-1878 https://vulnogram.org/CVE-2026-1878 An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the ex… Medium Thu, 12 Mar 2026 02:02:52 GMT https://vulnogram.org/CVE-2025-15037 https://vulnogram.org/CVE-2025-15037 An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially crafted IOCTL request, potentially leading to unauthor… Medium Thu, 12 Mar 2026 02:00:20 GMT https://vulnogram.org/CVE-2025-13348 https://vulnogram.org/CVE-2025-13348 An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered by a local user sending a specially crafted request, potentially leading to the creation of arbitrary files in… High Mon, 02 Feb 2026 02:00:38 GMT https://vulnogram.org/CVE-2025-12793 https://vulnogram.org/CVE-2025-12793 An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location, potentially resulting in arbitrary code execution. Refer to the ' Se… High Tue, 06 Jan 2026 02:14:37 GMT