CVE-2023-26911
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in ASUS SetupAsusServices v1.0.5.1 within Asus Armoury Crate v5.3.4.0 is caused by an unquoted service path, allowing local users to launch processes with elevated privileges.
Risk Assessment
A local attacker can exploit this flaw to escalate privileges, gaining administrator-level access to the system, potentially leading to full device compromise.
Recommendation
It is recommended to immediately update Asus Armoury Crate to the latest version and check if the vendor has released a patch for SetupAsusServices.
Other vulnerabilities in Asus Armoury Crate
See all- CVE-2026-16727High
A race condition vulnerability in ASUS Armoury Crate. A local user can exploit concurrent execution with improper synchronization to execute arbitrary code with elevated privileges via file replacement.
- CVE-2026-8918High
ASUS Armoury Crate has a vulnerability related to a permissive list of allowed inputs, allowing a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.
Original NVD description (English source)
ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.