PT-2020-14117 · Asus · Asus Screenpad2 Upgrade Tool+2

Published 2020-07-20 · Updated 2020-07-29 · CVE-2020-15009

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASUS ScreenPad2 Upgrade Tool versions 1.0.3

Description The issue allows for unsigned code execution with no additional restrictions when a user places an application at a specific path with a particular file name, potentially affecting ASUS PCs with ScreenPad 1.0, such as UX450FDX, UX550GDX, and UX550GEX models.

Recommendations For version 1.0.3, consider restricting access to the AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe executables until a patch is available. Avoid placing applications at the particular path with the specific file name that could lead to unsigned code execution.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2020-15009

Affected Products

Asus Screenpad2 Upgrade Tool

Asusscreenxpertservicec.Exe

Screenxpertupgradeservicemanager.Exe

References · 5

• https://osv.dev/vulnerability/CVE-2020-15009 · Vendor Advisory
• https://asus.com/Static_WebPage/ASUS-Product-Security-Advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15009 · Security Note
• https://asus.com/support/FAQ/1043674 · Vendor Advisory
• https://drive.google.com/file/d/1ClzHH5Jw3PgZw74RvKrEP8xU0TUc5Ta0/view?usp=sharing · Note