Vulnerabilidades em ASUS

186 resultados
Análise Vexday

Com 137 CVEs catalogadas, o portfólio de vulnerabilidades da ASUS apresenta uma taxa de exploração ativa 3,2 vezes acima da média geral do catálogo CISA KEV, o que indica que, proporcionalmente, as falhas nesse ecossistema têm maior chance de serem weaponizadas do que o esperado para vendors de porte similar. O tipo de falha mais recorrente é CWE-120 (buffer overflow clássico), uma classe de vulnerabilidade que frequentemente viabiliza execução remota de código e que exige atenção reforçada em processos de desenvolvimento e atualização de firmware. A CVE mais perigosa em exploração ativa no momento, CVE-2023-39780, registra um escore EPSS de 0,3216, sinalizando probabilidade relevante de exploração contínua e justificando priorização imediata de correção. Com 12 CVEs críticas e 7 novas entradas nos últimos 90 dias, equipes de segurança que operam ativos ASUS devem manter ciclos de patching curtos e monitorar ativamente indicadores de comprometimento associados às falhas confirmadas no KEV.

CVE-2026-3508MEDIUMAn Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) vEPSS 0.1%CVE-2025-9337MEDIUMA null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, whiEPSS 0.1%CVE-2026-7480HIGHAn Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate priviEPSS 0.1%CVE-2025-9338HIGHA improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. This vulnerability can be triggered byEPSS 0.1%CVE-2025-59373HIGHA local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when aEPSS 0.1%CVE-2022-4990HIGH** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypaEPSS 0.1%CVE-2026-19396HIGHA predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an uEPSS 0.1%CVE-2026-1878MEDIUMAn Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SEPSS 0.1%CVE-2025-11775MEDIUMAn out-of-bounds read vulnerability has been identified in the asComSvc service. This vulnerability can be triggered by sending specially crEPSS 0.1%CVE-2025-13348HIGHAn improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered bEPSS 0.1%CVE-2026-16003LOWExposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driEPSS 0.1%CVE-2026-16006MEDIUMExposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtEPSS 0.1%CVE-2026-16005MEDIUMRelease of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by EPSS 0.1%CVE-2026-16004MEDIUMExposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuratioEPSS 0.1%CVE-2019-25764HIGH**UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass theEPSS 0.1%CVE-2026-18023MEDIUMSensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive informatioEPSS 0.1%CVE-2026-16727HIGHConcurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to exeEPSS 0.1%CVE-2026-88781MEDIUMUntrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory addEPSS 0.1%CVE-2026-8920HIGHImproper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service alloEPSS 0.1%CVE-2026-112116HIGHAn exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbEPSS 0.1%