PT-2022-3523 · Asus · Asus Control Center

Cyku Hong · Published 2022-03-08 · Updated 2022-06-27 · CVE-2022-26668

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ASUS Control Center (affected versions not specified)

Description The issue is related to a broken access control vulnerability in the ASUS Control Center API. This allows an unauthenticated remote attacker to call privileged API functions, which can result in partial system operations or cause a partial disruption of service. The vulnerability is associated with insecure privilege management, potentially enabling a remote attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

BDU:2022-04304

CVE-2022-26668

Affected Products

Asus Control Center

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-26668 · Security Note
• https://bdu.fstec.ru/vul/2022-04304 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26668 · Vendor Advisory
• https://t.me/cibsecurity/44810 · Telegram Post
• https://twcert.org.tw/tw/cp-132-6055-c6500-1.html · Note
• https://vuldb.com/?id.202387 · Note