PT-2025-3110 · Asus · Asus System Analysis Io

Heyheysky · Published 2025-01-06 · Updated 2025-01-07 · CVE-2024-55408

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ASUS System Analysis IO version 1.0.0

Description The issue is related to improper access control in the AsusSAIO.sys driver, which may allow the misuse of software functionality when crafted IOCTL requests are supplied. This can lead to arbitrary read and write actions, potentially allowing attackers to perform unauthorized operations.

Recommendations For ASUS System Analysis IO version 1.0.0, consider disabling the AsusSAIO.sys driver until a patch is available to prevent the misuse of software functionality. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using crafted IOCTL requests in the affected driver until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-55408

Affected Products

Asus System Analysis Io

References · 9

• 🔥 https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55408/CVE-2024-55408_AsusSAIO.sys_README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55408 · Security Note
• https://asus.com/tw/support/myasus-deeplink · Note
• https://twitter.com/CVEnew/status/1876345862705598804 · Twitter Post
• http://asus.com · Note
• https://t.me/cvedetector/14401 · Telegram Post
• https://github.com/heyheysky/vulnerable-driver · Note
• https://t.me/thedarkwebinformer/10130 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1876390925796094098 · Twitter Post