CVE-2025-13348

High

Published: 02/02/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

An improper access control vulnerability exists in the ASUS Secure Delete Driver of ASUS Business Manager. A local user can trigger it by sending a specially crafted request, potentially leading to arbitrary file creation in a specified path.

Risk Assessment

The risk involves potential privilege escalation or system integrity compromise by a local attacker who can write files to arbitrary locations, possibly leading to full system control.

Recommendation

Apply the security update provided by ASUS in their security advisory immediately. Also restrict local access to systems running ASUS Business Manager.

Other vulnerabilities in ASUS Business Manager

CVE-2026-8921High
A vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. The issue stems from external control of file name or path.

Original NVD description (English source)

An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered by a local user sending a specially crafted request, potentially leading to the creation of arbitrary files in a specified path. Refer to the "Security Update for ASUS Business Manager" section on the ASUS Security Advisory for more information.