ASUS

Latest CVEs · RSS

• CVE-2026-14911 2026-10-07 · CVSS 9.3
  Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, mo
• CVE-2026-19396 2026-10-07 · CVSS 7.7
  A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearb
• CVE-2026-19386 2026-10-07 · CVSS 9.3
  A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload t
• CVE-2026-16528 2026-10-07 · CVSS 8.4
  Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system
• CVE-2026-13313 2026-10-01 · CVSS 8.9
  An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms a
• CVE-2026-14157 2026-10-01 · CVSS 9.4
  Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uplo
• CVE-2026-93495 2026-10-01 · CVSS 7.0
  Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted de
• CVE-2026-19397 2026-09-08 · CVSS 7.7
  Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct conne
• CVE-2026-12962 2026-09-08 · CVSS 5.3
  A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user
• CVE-2026-18023 2026-09-08 · CVSS 5.7
  Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized
• CVE-2026-16003 2026-09-08 · CVSS 2.0
  Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via
• CVE-2026-16004 2026-09-08 · CVSS 5.9
  Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted
• CVE-2026-16005 2026-09-08 · CVSS 5.8
  Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver
• CVE-2026-16006 2026-09-08 · CVSS 5.7
  Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a
• CVE-2026-75808 2026-09-08 · CVSS 5.7
  Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exha
• CVE-2026-75809 2026-09-08 · CVSS 5.9
  Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassi
• CVE-2026-75810 2026-09-08 · CVSS 5.7
  Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing driver authentication and sending reque
• CVE-2026-75811 2026-09-08 · CVSS 5.8
  Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potenti
• CVE-2026-75754 2026-09-04 · CVSS 10.0
  Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized
• CVE-2026-19398 2026-08-27 · CVSS 6.8
  An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local  administrator to cause a system crash (BSOD) or BIOS corrupti
• CVE-2026-8917 2026-08-11 · CVSS 8.4
  Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value
• CVE-2026-16727 2026-07-30 · CVSS 7.3
  Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code
• CVE-2019-25764 2026-07-17 · CVSS 7.3
  **UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verificati
• CVE-2026-13385 2026-07-15 · CVSS 9.5
  An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user t
• CVE-2026-15029 2026-07-15 · CVSS 8.4
  Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perf