Mọi CVE đã công bố cùng các advisory mã nguồn mở (NVD, OSV, GitHub), kèm CVSS, EPSS và cho biết lỗ hổng có đang bị khai thác thực tế hay không (CISA KEV). Cập nhật mỗi vài giờ. Các bài quét đối chiếu dữ liệu này với công nghệ phát hiện được trên site.
| 14/06/2024 |
| CVE-2024-31160 | TRUNG BÌNH4.8 | The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Stored Cross-site scripting attacks. | 14/06/2024 |
| CVE-2024-31159 | TRUNG BÌNH4.8 | The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks. | 14/06/2024 |
| CVE-2024-33220 | CAO8.8 | An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. | 22/05/2024 |
| CVE-2023-5716 | NGHIÊM TRỌNG9.8 | ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP requests without permission. | 19/01/2024 |
| CVE-2023-26911 | CAO7.8 | ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. | 26/07/2023 |
| CVE-2022-42455 | CAO7.8 | ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges | 15/02/2023 |
| CVE-2022-44898 | CAO7.8 | The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allowing attackers to trigger a memory corruption and cause a Denial of Service (DoS) or escalate privileges via crafted IOCTL requests. | 14/12/2022 |
| CVE-2022-36439 | TRUNG BÌNH6.0 | AsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the Temp directory and delete another more privileged file via SYSTEM privileges. This affects ASUS System Control Interface 3 before 3.1.5.0, AsusSoftwareManger.exe before 1.0.53.0, a | 18/10/2022 |
| CVE-2022-36438 | CAO7.8 | AsusSwitch.exe on ASUS personal computers (running Windows) sets weak file permissions, leading to local privilege escalation (this also can be used to delete files within the system arbitrarily). This affects ASUS System Control Interface 3 before 3.1.5.0, and AsusSwitch.exe before 1.0.10.0. | 18/10/2022 |
| CVE-2022-38699 | TRUNG BÌNH5.9 | Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrup | 28/09/2022 |
| CVE-2022-35899 | CAO7.8 | There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\ASUS\GameSDK.exe file. | 21/07/2022 |
| CVE-2022-26669 | TRUNG BÌNH6.5 | ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data. | 20/06/2022 |
| CVE-2022-26668 | TRUNG BÌNH6.5 | ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service. | 20/06/2022 |
| CVE-2022-26672 | NGHIÊM TRỌNG9.8 | ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a general user account allows the attacker to access, modify or delete this user a | 22/04/2022 |
| CVE-2022-22814 | NGHIÊM TRỌNG9.8 | The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation. | 10/03/2022 |
| CVE-2022-22262 | CAO7.7 | ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic link to system file path, to delete arbitrary | 01/03/2022 |
| CVE-2021-40981 | CAO7.3 | ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\GamingCenterLib directory. | 27/09/2021 |