CVE-2026-13585
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in the ASUS System Control Interface driver and ASUS Business Manager allows a local administrator to disclose sensitive information via crafted IOCTL requests. In severe cases, this may lead to a Denial of Service (DoS) on the system.
Risk Assessment
The risk includes leakage of sensitive system data and potential system disruption, which may impact the availability and security of the IT infrastructure.
Recommendation
It is recommended to immediately apply the security update provided by ASUS in the ASUS Security Advisory for the ASUS System Control Interface component.
Other vulnerabilities in ASUS System Control Interface
See all- CVE-2026-15030Medium
An out-of-bounds read vulnerability in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by sending a crafted IOCTL request that bypasses validation.
- CVE-2026-15029High
A vulnerability in the ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager drivers allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests, bypassing OS-enforced memory protections.
- CVE-2026-7480High
An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary code via a crafted RPC call that bypasses the validation mechanism.
Original NVD description (English source)
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.