Dan Kelly

**Name of the Vulnerable Software and Affected Versions** ASUS EC Tool driver (aka d.sys) versions prior to the fixed version asus armoury crate versions prior to 5.3.4.1 **Description** The issue concerns a driver that provides raw read and write access to port I/O and MSRs via unprivileged IOCTL calls, allowing local users to gain privileges. This has been exploited in real-world incidents, including attacks by the Lazarus group, which targeted security researchers and media companies in the US and Europe. The attackers used phishing schemes, including sending malicious documents, to deploy backdoors and gain control over targeted systems. The estimated number of potentially affected devices is not specified. **Recommendations** For ASUS EC Tool driver (aka d.sys) versions prior to the fixed version: Update to the latest version that contains the fix for this issue. For asus armoury crate versions prior to 5.3.4.1: Update to version 5.3.4.1 or later to resolve the issue. As a temporary workaround, consider disabling the vulnerable IOCTL handlers until a patch is available. Restrict access to the affected driver to minimize the risk of exploitation. Avoid using the affected driver in sensitive environments until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine ADSelfService Plus versions prior to 6122 **Description** The issue allows a remote authenticated administrator to execute arbitrary operating system commands as SYSTEM via the policy custom script feature. This can be exploited due to the use of a default administrator password, making it easier for attackers to abuse this functionality. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field, specifically the `password` field. This vulnerability can be exploited when a certain password sync feature is enabled, which uses passwords as script arguments, allowing for remote code execution via executable CMD.EXE input. **Recommendations** For versions prior to 6122, update to a version that includes the fix for this issue, specifically build 6122 or later, to prevent remote code execution. As a temporary workaround, consider disabling the policy custom script feature until a patch is available. Restrict access to the password sync feature that uses passwords as script arguments to minimize the risk of exploitation. Avoid using the `password` field in the custom script until the issue is resolved.