PT-2025-51805 · Asrock · Asrockrack Motherboards+2

Mohamed Al-Sharifi + 1 · Published 2025-12-17 · Updated 2025-12-24 · CVE-2025-14304

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASRock, ASRockRack, and ASRockInd motherboards (affected versions not specified)

Description Certain motherboard models developed by ASRock and its subsidiaries, ASRockRack and ASRockInd, exhibit a Protection Mechanism Failure. This is due to IOMMU not being properly enabled. An unauthenticated physical attacker with a DMA-capable PCIe device can read and write arbitrary physical memory before the operating system kernel and its security features are loaded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2026-00909

CVE-2025-14304

Affected Products

Asrock Motherboards

Asrockind Motherboards

Asrockrack Motherboards

References · 16

• https://asrockind.com/zh-tw/security-center · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00909 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-14304 · Security Note
• https://asrock.com/support/Security.asp · Vendor Advisory
• https://xakep.ru/2025/12/22/uefi-bug · Note
• https://twitter.com/craigbob99/status/2003825140187218125 · Twitter Post
• https://t.me/cveNotify/146049 · Telegram Post
• https://asrockind.com/zh-tw/index.php?route=newsblog/security&security_id=3 · Note
• https://asrock.com/support/Security.asp?iD=1 · Note
• https://habr.com/ru/news/978790/?ysclid=mkxsj7feol266182909 · Note
• https://twcert.org.tw/en/cp-139-10579-9205b-2.html · Note
• https://twitter.com/VulmonFeeds/status/2001206528334803105 · Twitter Post
• https://t.me/CVEtracker/40026 · Telegram Post
• https://twitter.com/CVEnew/status/2001350831116013916 · Twitter Post
• https://t.me/true_secator/7748 · Telegram Post