Loading story…
ASUS patched two vulnerabilities in its preinstalled DriverHub software that can be chained to achieve unauthenticated remote code execution on affected Windows systems. The flaws, tracked as CVE-2025-3462 and CVE-2025-3463, affect DriverHub versions earlier than 1.0.6.0 and stem from insufficient certificate and origin validation in the utility’s update and installation workflow. Researchers reported that the bugs allow a malicious website to interact with DriverHub through specially crafted HTTP requests and trigger code execution with minimal user interaction.
According to public reporting and ASUS’s security advisory, the attack abuses a driverhub.asus.com.<arbitrary>.com-style domain to pass validation checks, causing DriverHub to launch AsusSetup.exe in silent mode and process a malicious AsusSetup.ini file that redirects installation to attacker-controlled code. CSIRT.SK said successful exploitation could fully compromise the confidentiality, integrity, and availability of a victim machine. ASUS has released updates and urged users to upgrade DriverHub immediately to version 1.0.6.0 or later.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
ASUS released security updates for ASUS DriverHub to fix two vulnerabilities, including a critical flaw, affecting versions earlier than 1.0.6.0. The issues, tracked as CVE-2025-3462 and CVE-2025-3463, could be chained for remote code execution and ASUS recommended upgrading to version 1.0.6.0.
CSIRT.SK published a summary describing the ASUS DriverHub flaws as enabling remote unauthenticated compromise via insufficient certificate and origin validation, crafted HTTP requests, and user interaction with a malicious website. The write-up noted the attack could trigger AsusSetup.exe in silent mode and process a malicious AsusSetup.ini file to run attacker-controlled code.
A researcher published details of a one-click remote code execution issue in ASUS's preinstalled DriverHub software. The disclosure described how the flaws could be exploited through a malicious website targeting DriverHub's update-related behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcemrbruh.com
Open sourceasus.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos disclosed multiple high-severity vulnerabilities in the `AsIO3.sys` kernel driver used by **ASUS Armoury Crate** and related utilities, including an authorization bypass tracked as **CVE-2025-3464**. The bypass affects Armoury Crate versions `5.9.9.0` through `6.1.18.0` and lets a low-privileged authenticated attacker abuse a race condition and a specially crafted hard link to defeat the driver’s SHA-256-based validation of `AsusCertService.exe`, obtain access to the `\Device\Asusgio3` device, and escalate privileges to **SYSTEM**. Talos said the exposed device functionality includes physical memory mapping, I/O port access, and MSR register access, creating a path to full system compromise. Talos also reported a separate stack-based buffer overflow in the same driver family, affecting **Armoury Crate 5.9.13.0**, **AI Suite 3 1.0.0.0**, and **AsIO3 Driver 1.02.30**, where a path-conversion routine copies an application image path into a fixed-size stack buffer without proper length checks. A specially crafted long path can trigger stack corruption during handle acquisition for the Asusgio3 device, and Talos confirmed the condition with a `DRIVER_OVERRAN_STACK_BUFFER` bugcheck. ASUS has released patches for the issues and urged users and administrators to update affected software immediately.
Jul 24, 2026
ASUS disclosed a high-severity vulnerability tracked as **CVE-2026-8917** affecting multiple Windows utilities, including **GPU Tweak III**, **GPUTweakII**, **AI Suite3**, and **VGAdll**. The flaw stems from an untrusted pointer dereference in an `IOCTL` handler that can let a local attacker write a specific value to an arbitrary memory address, creating a path to **privilege escalation** on affected systems. The issue carries a **CVSS 4.0 score of 8.4** and is classified under **CWE-822**. While the vulnerability is **not remotely exploitable**, national CERT notices and the CVE entry point users to ASUS security advisories and patched software versions as the primary mitigation, making updates a priority for organizations running the affected ASUS management and tuning tools.
Aug 16, 2026
ASUS has released firmware and software updates for seven vulnerabilities across ASUSWRT routers and several Windows components, led by **CVE-2026-13385**, a critical router flaw rated **CVSS 9.5**. The issue affects CN SKU ASUS routers using the UU feature and, according to ASUS advisories, could let a machine-in-the-middle attacker spoof the update server and execute arbitrary commands without credentials; other reporting describes the bug as stemming from improper input validation in router management components and affecting firmware branches including `3.0.0.4_386`, `3.0.0.4_388`, and `3.0.0.6_102`. Successful exploitation could give attackers control of edge devices, enabling traffic interception, malware deployment, and broader network compromise. The broader advisory set also covers flaws in **ASUS System Control Interface v3**, **ASUS Business Manager**, **Aura Wallpaper Service**, **GameSDK**, and router web interfaces, with impacts including physical memory access, information disclosure, denial of service, unauthorized file operations, credential exposure, and data tampering. ASUS said none of the vulnerabilities are confirmed to be under active exploitation and that no public proof-of-concept is known for the critical router issue, but urged customers to apply updates immediately, disable remote administration or affected router features if patching is delayed, restrict management access to trusted IP ranges, use strong credentials, and replace end-of-life routers no longer supported after March 2026.
Jul 22, 2026