Loading story…
ASUS disclosed CVE-2026-13585, a high-severity flaw affecting ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager. The vulnerability stems from improper handling of driver resources, including allocation without limits and failure to clear sensitive data before reuse, allowing a local administrator to use crafted IOCTL requests to disclose sensitive information. In severe cases, the issue can also trigger a denial of service on the affected host, according to the CVE record and ASUS advisory.
Public discussion identified the affected kernel driver as bsitf.sys / AsusBSItf.sys and described the bug as an arbitrary physical memory mapping issue tied to unvalidated IOCTL handling. Posts circulating in security and administrator forums said a technical write-up and proof of concept had been published, increasing visibility into the flaw and its potential abuse as a local kernel-level security risk on ASUS business systems. ASUS has published remediation guidance and countermeasures for impacted products.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Reddit posts drew attention to CVE-2026-13585 as an ASUS bsitf.sys / AsusBSItf.sys issue described as arbitrary physical memory mapping via an unvalidated IOCTL. One post said a full technical analysis and proof of concept by Ahmad Zahran was available and that ASUS had released a vendor advisory with countermeasures.
A new vulnerability, CVE-2026-13585, was published affecting ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager. The flaw can allow sensitive information disclosure via crafted IOCTL requests and, in severe cases, denial of service; the CVE record also references an ASUS security advisory.
A blog post by Ahmad Zahran published a technical analysis and proof of concept for the ASUS bsitf.sys issue described as arbitrary physical memory mapping. This constitutes public release of exploit details for the vulnerability later tracked as CVE-2026-13585.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcereddit.com
Open sourcecvefeed.io
Open sourcecve.org
Open sourceblog.ahmadz.ai
Open sourceseclists.org
Open sourceasus.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ASUS disclosed a high-severity vulnerability tracked as **CVE-2026-8917** affecting multiple Windows utilities, including **GPU Tweak III**, **GPUTweakII**, **AI Suite3**, and **VGAdll**. The flaw stems from an untrusted pointer dereference in an `IOCTL` handler that can let a local attacker write a specific value to an arbitrary memory address, creating a path to **privilege escalation** on affected systems. The issue carries a **CVSS 4.0 score of 8.4** and is classified under **CWE-822**. While the vulnerability is **not remotely exploitable**, national CERT notices and the CVE entry point users to ASUS security advisories and patched software versions as the primary mitigation, making updates a priority for organizations running the affected ASUS management and tuning tools.
Aug 16, 2026
Cisco Talos disclosed multiple high-severity vulnerabilities in the `AsIO3.sys` kernel driver used by **ASUS Armoury Crate** and related utilities, including an authorization bypass tracked as **CVE-2025-3464**. The bypass affects Armoury Crate versions `5.9.9.0` through `6.1.18.0` and lets a low-privileged authenticated attacker abuse a race condition and a specially crafted hard link to defeat the driver’s SHA-256-based validation of `AsusCertService.exe`, obtain access to the `\Device\Asusgio3` device, and escalate privileges to **SYSTEM**. Talos said the exposed device functionality includes physical memory mapping, I/O port access, and MSR register access, creating a path to full system compromise. Talos also reported a separate stack-based buffer overflow in the same driver family, affecting **Armoury Crate 5.9.13.0**, **AI Suite 3 1.0.0.0**, and **AsIO3 Driver 1.02.30**, where a path-conversion routine copies an application image path into a fixed-size stack buffer without proper length checks. A specially crafted long path can trigger stack corruption during handle acquisition for the Asusgio3 device, and Talos confirmed the condition with a `DRIVER_OVERRAN_STACK_BUFFER` bugcheck. ASUS has released patches for the issues and urged users and administrators to update affected software immediately.
Jul 24, 2026
ASUS has released security advisories addressing several critical vulnerabilities affecting its routers and PC software. Notably, CVE-2025-59366 is an authentication bypass flaw in the AiCloud feature of ASUS routers, with a CVSS score of 9.4, allowing attackers to execute specific functions without proper authorization due to a Samba-related issue. Additionally, CVE-2025-12003 is a path traversal vulnerability in the WebDAV component of ASUS router firmware, enabling unauthenticated remote attackers to compromise device integrity. Another high-severity issue, CVE-2025-59373, impacts the ASUS System Control Interface Service used by the MyASUS application, allowing local privilege escalation to SYSTEM on Windows devices through a flawed file-restore mechanism. ASUS has provided patches for these vulnerabilities and urges users to update affected devices immediately. The vulnerabilities impact a wide range of ASUS products, including desktop PCs, laptops, NUC systems, All-in-One machines, and various router models. Attackers exploiting these flaws could gain unauthorized access, escalate privileges, or execute arbitrary code, posing significant risks to both home and enterprise environments. Users are advised to verify their device firmware and software versions and apply the latest security updates via Windows Update or the ASUS Support site to mitigate these threats.
Jun 29, 2026