{"id":8737,"date":"2025-11-26T10:00:48","date_gmt":"2025-11-26T10:00:48","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/11\/26\/asus-myasus-flaw-lets-hackers-escalate-to-system-level-access\/"},"modified":"2025-11-26T10:00:48","modified_gmt":"2025-11-26T10:00:48","slug":"asus-myasus-flaw-lets-hackers-escalate-to-system-level-access","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/11\/26\/asus-myasus-flaw-lets-hackers-escalate-to-system-level-access\/","title":{"rendered":"ASUS MyASUS Flaw Lets Hackers Escalate to SYSTEM-Level Access"},"content":{"rendered":"

ASUS MyASUS Flaw Lets Hackers Escalate to SYSTEM-Level Access
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

ASUS has disclosed a high security vulnerability in its MyASUS application that could allow local attackers to escalate their privileges to SYSTEM-level access on affected Windows devices<\/a>.<\/p>\n

The flaw, tracked as CVE-2025-59373, carries a high-severity CVSS 4.0 score of 8.5, indicating a significant risk to millions of ASUS computer users worldwide.<\/p>\n

Vulnerability Overview<\/strong><\/h2>\n

The security flaw resides in the ASUS System Control Interface Service, a core component of the MyASUS application that manages hardware settings and system utilities on ASUS personal computers.<\/p>\n

The vulnerability enables attackers with low-level local access to escalate their privileges to SYSTEM-level, granting them complete control over the affected machine.<\/p>\n

\n\n\n\n\n\n
CVE ID<\/strong><\/td>\nAffected Product<\/strong><\/td>\nImpact<\/strong><\/td>\nCVSS 4.0 Score<\/strong><\/td>\nExploit Prerequisites<\/strong><\/td>\n<\/tr>\n<\/thead>\n
CVE-2025-59373<\/td>\nASUS System Control Interface Service (MyASUS)<\/td>\nPrivilege Escalation to SYSTEM<\/td>\n8.5 (High)<\/td>\nLocal access with low privileges<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

With SYSTEM-level access, threat actors can execute arbitrary code, install malware<\/a>, access sensitive data, modify system configurations, and potentially move laterally across enterprise networks.<\/p>\n

This makes the vulnerability particularly dangerous in corporate environments where a single compromised endpoint could lead to broader network intrusion.<\/p>\n

The vulnerability requires local access to exploit, meaning an attacker must already have some level of access to the target system.<\/p>\n

However, the attack complexity is low, requires no user interaction, and only minimal privileges are needed to trigger the exploit.<\/p>\n

The potential impact spans high confidentiality, integrity, and availability concerns, though the scope remains unchanged beyond the vulnerable component.<\/p>\n

The vulnerability affects all ASUS personal computers running the MyASUS application, including desktops, laptops<\/a>, NUC systems, and All-in-One PCs. ASUS has released patched versions to address the issue.<\/p>\n

Users should update to the following fixed versions immediately:<\/p>\n