PT-2020-12268 · Asus+1 · Asus Device Activation+1

Published 2020-03-25 · Updated 2021-07-21 · CVE-2020-10649

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASUS Device Activation versions prior to 1.0.7.0

Description The issue allows for unsigned code execution with no additional restrictions when a user places an application at a specific path with a particular file name. This is related to DevActSvc.exe in ASUS Device Activation for Windows 10 notebooks and PCs.

Recommendations For versions prior to 1.0.7.0, update to version 1.0.7.0 or later to resolve the issue.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-10649

Affected Products

Asus Device Activation

Windows 10

References · 8

• 🔥 https://drive.google.com/file/d/1Ap293b7bZLen6DmheppR1IUFEAsCSORC/view?usp=sharing · Exploit
• https://asus.com/support/FAQ/1042640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10649 · Security Note
• https://asus.com/Laptops/ASUS-TUF-Gaming-FX504/HelpDesk_Download · Vendor Advisory
• https://asus.com/Static_WebPage/ASUS-Product-Security-Advisory · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10649 · Vendor Advisory
• https://t.me/cibsecurity/10807 · Telegram Post
• https://t.me/cvenotify/2134 · Telegram Post