Asus
206 CVEs across 1019 Asus products. Browse Asus vulnerabilities, severities, and proof-of-concept exploits.
Asus products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8917 | | 2026-08-11 | Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific valu… | |
CVE-2026-16727 | | 2026-07-30 | Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code… | |
CVE-2019-25764 | | 2026-07-17 | **UNSUPPORTED WHEN ASSIGNED** Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verificat… | |
CVE-2026-8920 | | 2026-07-15 | Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to p… | |
CVE-2026-8919 | | 2026-07-15 | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user t… | |
CVE-2026-15030 | | 2026-07-15 | Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory re… | |
CVE-2026-15029 | | 2026-07-15 | Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to per… | |
CVE-2026-13585 | | 2026-07-15 | Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface drive… | |
CVE-2026-13385 | | 2026-07-15 | An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user… | |
CVE-2026-11851 | | 2026-07-15 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a rem… | |
CVE-2026-8921 | | 2026-07-03 | External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampere… | |
CVE-2026-12960 | | 2026-07-03 | An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Int… | |
CVE-2022-4990 | | 2026-07-03 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validat… | |
CVE-2022-4989 | | 2026-07-03 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memor… | |
CVE-2026-8918 | | 2026-06-22 | A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system cras… | |
CVE-2026-8070 | | 2026-05-29 | Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthor… | |
CVE-2026-7480 | | 2026-05-29 | An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and… | |
CVE-2026-6737 | | 2026-05-08 | An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms and obtain restricted… | |
CVE-2026-3508 | | 2026-05-08 | An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) via a read size that… | |
CVE-2026-3428 | | 2026-04-16 | A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege escalation… | |
CVE-2026-1880 | | 2026-04-16 | An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protect… | |
CVE-2025-15101 | High | 8.8 | 2026-03-26 | An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbit… |
CVE-2026-1878 | | 2026-03-12 | An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerab… | |
CVE-2025-15038 | | 2026-03-12 | An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local… | |
CVE-2025-15037 | | 2026-03-12 | An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivi… | |
CVE-2025-13348 | | 2026-02-02 | An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered by a local user send… | |
CVE-2025-12793 | High | 7.8 | 2026-01-06 | An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacke… |
CVE-2025-59374 | Critical | 9.8 | 2025-12-17 | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain… |
CVE-2025-11901 | | 2025-12-17 | An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z… | |
CVE-2025-11775 | | 2025-12-17 | An out-of-bounds read vulnerability has been identified in the asComSvc service. This vulnerability can be triggered by sending specially crafted requests, whi… | |
CVE-2025-59372 | | 2025-11-25 | A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files o… | |
CVE-2025-59371 | | 2025-11-25 | An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability… | |
CVE-2025-59370 | | 2025-11-25 | A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbit… | |
CVE-2025-59369 | | 2025-11-25 | A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary… | |
CVE-2025-59368 | | 2025-11-25 | An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, poten… | |
CVE-2025-59366 | | 2025-11-25 | An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentia… | |
CVE-2025-59365 | | 2025-11-25 | A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a craft… | |
CVE-2025-12003 | | 2025-11-25 | A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device. Refer to… | |
CVE-2025-59373 | | 2025-11-25 | A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged acto… | |
CVE-2025-59367 | Critical | 9.8 | 2025-11-13 | An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affec… |
CVE-2025-9338 | | 2025-11-06 | A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. This vulnerability can be triggered by manually executing… | |
CVE-2025-9337 | | 2025-10-13 | A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a sy… | |
CVE-2025-9336 | | 2025-10-13 | A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (… | |
CVE-2025-9968 | | 2025-10-13 | A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junct… | |
CVE-2025-6398 | | 2025-08-01 | A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered by a specially crafted input… | |
CVE-2025-4570 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… | |
CVE-2025-4569 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… | |
CVE-2025-3464 | | 2025-06-16 | A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication… | |
CVE-2025-1533 | | 2025-05-12 | A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (… | |
CVE-2025-3463 | | 2025-05-09 | "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS Dr… | |
CVE-2025-3462 | | 2025-05-09 | "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may al… | |
CVE-2025-2492 | | 2025-04-18 | An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthoriz… | |
CVE-2025-2027 | | 2025-03-28 | A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC… | |
CVE-2025-1354 | | 2025-02-16 | A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be trigge… | |
CVE-2024-12957 | | 2025-01-23 | A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for… | |
CVE-2024-55408 | Medium | 5.3 | 2025-01-06 | An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL re… |
CVE-2024-13062 | High | 7.2 | 2025-01-02 | An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution. Refer to the ' 01/02/202… |
CVE-2024-12912 | High | 7.2 | 2025-01-02 | An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiC… |
CVE-2024-11985 | Medium | 4.4 | 2024-12-04 | An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router Improper Input Validati… |
CVE-2024-3912 | Critical | 9.8 | 2024-06-14 | Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute ar… |
CVE-2024-31163 | High | 7.2 | 2024-06-14 | ASUS Download Master has a buffer overflow vulnerability. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to e… |
CVE-2024-31162 | High | 7.2 | 2024-06-14 | The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges… |
CVE-2024-31161 | High | 7.2 | 2024-06-14 | The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerabi… |
CVE-2024-31160 | Medium | 4.8 | 2024-06-14 | The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can ins… |
CVE-2024-31159 | Medium | 4.8 | 2024-06-14 | The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can ins… |
CVE-2024-3080 | Critical | 9.8 | 2024-06-14 | Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device. |
CVE-2024-3079 | High | 7.2 | 2024-06-14 | Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on… |
CVE-2024-33220 | High | 8.8 | 2024-05-22 | An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via… |
CVE-2024-33219 | High | 7.8 | 2024-05-22 | An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary… |
CVE-2024-0401 | High | 7.2 | 2024-05-20 | ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary op… |
CVE-2023-35720 | Medium | 6.5 | 2024-05-03 | ASUS RT-AX92U lighttpd mod_webdav.so SQL Injection Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensi… |
CVE-2024-1655 | High | 8.8 | 2024-04-15 | Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by s… |
CVE-2024-26342 | High | 7.5 | 2024-02-28 | A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet. |
CVE-2023-5716 | Critical | 9.8 | 2024-01-19 | ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP request… |
CVE-2023-47678 | Critical | 9.1 | 2023-11-15 | An improper access control vulnerability exists in RT-AC87U all versions. An attacker may read or write files that are not intended to be accessed by connectin… |
CVE-2023-41348 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An au… |
CVE-2023-41347 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authentica… |
CVE-2023-41346 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenti… |
CVE-2023-41345 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authen… |
CVE-2023-41349 | High | 8.8 | 2023-09-18 | ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attack… |
CVE-2023-39780 | High | 8.8 | 2023-09-11 | On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: f… |
CVE-2023-39240 | High | 7.2 | 2023-09-07 | It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a speci… |
CVE-2023-39239 | High | 7.2 | 2023-09-07 | It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific v… |
CVE-2023-39238 | High | 7.2 | 2023-09-07 | It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_ipe… |
CVE-2023-39237 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exp… |
CVE-2023-39236 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U Traffic Analyzer - Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit… |
CVE-2023-38033 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege… |
CVE-2023-38032 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can explo… |
CVE-2023-38031 | High | 8.8 | 2023-09-07 | ASUS RT-AC86U Adaptive QoS - Web History function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit t… |
CVE-2023-39086 | High | 7.5 | 2023-08-08 | ASUS RT-AC66U B1 3.0.0.4.286_51665 was discovered to transmit sensitive information in cleartext. |
CVE-2023-34360 | High | 8.2 | 2023-07-31 | A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.2311… |
CVE-2023-34359 | High | 7.5 | 2023-07-31 | ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to the device which causes the htt… |
CVE-2023-34358 | High | 7.5 | 2023-07-31 | ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a speci… |
CVE-2023-26911 | High | 7.8 | 2023-07-26 | ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes wit… |
CVE-2023-35087 | Critical | 9.8 | 2023-07-21 | It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when ca… |
CVE-2023-35086 | High | 7.2 | 2023-07-21 | It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when ca… |
CVE-2023-31195 | Medium | 5.3 | 2023-06-13 | ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be a… |
CVE-2023-34942 | High | 7.5 | 2023-06-12 | Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. NOTE: This vulnerability only affects pro… |
CVE-2023-34941 | Medium | 5.4 | 2023-06-12 | A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scr… |
CVE-2023-34940 | High | 7.5 | 2023-06-12 | Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the url parameter at /start-apply.html. NOTE: This vulnerability only affects pro… |