CVE-2025-59373
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM.
Risk Assessment
A low-privileged local attacker can achieve code execution as SYSTEM, posing a serious threat to the system.
Recommendation
Apply the Security Update for MyASUS as described in the ASUS Security Advisory.
Other vulnerabilities in ASUS System Control Interface
See all- CVE-2026-15030Medium
An out-of-bounds read vulnerability in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by sending a crafted IOCTL request that bypasses validation.
- CVE-2026-15029High
A vulnerability in the ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager drivers allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests, bypassing OS-enforced memory protections.
- CVE-2026-13585High
A vulnerability in the ASUS System Control Interface driver and ASUS Business Manager allows a local administrator to disclose sensitive information via crafted IOCTL requests. In severe cases, this may lead to a Denial of Service (DoS) on the system.
- CVE-2026-7480High
An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary code via a crafted RPC call that bypasses the validation mechanism.
- CVE-2026-3508Medium
An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) via a read size that exceeds the buffer size.
Original NVD description (English source)
A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more information, please refer to section Security Update for MyASUS in the ASUS Security Advisory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS