PT-2026-24909 · Asus · Asus Business System Control Interface

CVE-2025-15037 · Publicado 2026-03-11 · Atualizado 2026-03-18

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Média

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ASUS Business System Control Interface driver (affected versions not specified)

Description An Incorrect Permission Assignment issue exists in the ASUS Business System Control Interface driver. This issue can be triggered by a local user without elevated privileges sending a specially crafted IOCTL request. This could lead to unauthorized access to sensitive hardware resources and kernel information disclosure. An IOCTL (Input/Output Control) request is a method used by applications to communicate with device drivers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

BDU:2026-04443

CVE-2025-15037

Produtos afetados

Asus Business System Control Interface

Referências · 10

• https://sentinelone.com/vulnerability-database/cve-2025-15037 · Nota
• https://t.me/CVEtracker/47215 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2031992346636927175 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15037 · Nota de Segurança
• https://asus.com/content/security-advisory · Nota
• https://twitter.com/CVEarity/status/2032076481309155830 · Publicação no Twitter
• https://t.me/cveNotify/155216 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2026-04443 · Nota de Segurança
• https://asus.com/security-advisory · Nota
• https://twitter.com/ewilded/status/2034200033986331004 · Publicação no Twitter