CVE-2024-27673

CVE-2024-27673 ASUS Control Center Express = 01.06.15 - Unquoted Service Path Description: ASUS Control Center Express Version = 01.06.15 contains an unquoted service path which allows attackers to escalate privileges to the system level. Assuming attackers have write access to C:, the attackers...

CVE-2026-19397

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

EUVD-2026-72612

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

CVE-2026-19397

CVE-2026-19397 is a missing authentication vulnerability in ASUS Control Center Express Agent . When the host has an active login session, an unauthenticated user on the adjacent network can directly connect to the agent and control the host. The flaw affects a critical function within the agent ...

CVE-2026-19397

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

PT-2026-86974

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

CVE-2026-75754

Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...

CVE-2026-75754

ASUS Control Center is affected by a combination of Missing Authentication for Critical Function , Server-Side Request Forgery (SSRF) , and Use of Hard-coded Credentials . An unauthorized network-based attacker with no prior privileges can obtain the encryption key via an HTTP request , causing a...

EUVD-2026-70865

Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...

CVE-2026-75754

Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...

PT-2026-85382

Name of the Vulnerable Software and Affected Versions ASUS Control Center Enterprise versions 0 through 4.0.0.2 Description An issue involving missing authentication for critical functions, Server-Side Request Forgery SSRF, and the use of hard-coded credentials allows an unauthenticated network...

ASUS Control Center Express 01.06.15 - Unquoted Service Path Vulnerability

Exploit Title: ASUS Control Center Express 01.06.15 - Unquoted Service Path Privilege Escalation Exploit Author: Alaa Kachouh Vendor Homepage: https://www.asus.com/campaign/ASUS-Control-Center-Express/global/ Version: Up to 01.06.15 Tested on: Windows CVE: CVE-2024-27673...

ASUS Control Center Express 01.06.15 Unquoted Service Path

Exploit Title: ASUS Control Center Express 01.06.15 - Unquoted Service Path Privilege Escalation Date: 2024-04-02 Exploit Author: Alaa Kachouh Vendor Homepage: https://www.asus.com/campaign/ASUS-Control-Center-Express/global/ Version: Up to 01.06.15 Tested on: Windows CVE: CVE-2024-27673...

ASUS Control Center Express 01.06.15 - Unquoted Service Path

Exploit Title: ASUS Control Center Express 01.06.15 - Unquoted Service Path Privilege Escalation Date: 2024-04-02 Exploit Author: Alaa Kachouh Vendor Homepage: https://www.asus.com/campaign/ASUS-Control-Center-Express/global/ Version: Up to 01.06.15 Tested on: Windows CVE: CVE-2024-27673...

The vulnerability of the ASUS Control Center, which involves insecure management of privileges, allows a perpetrator to escalate their privileges or cause a partial service failure.

The vulnerability of the ASUS Control Center, a component of information technology management systems, is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to increase their privileges or cause partial service interruptions...

ASUS Control Center SQL Injection Vulnerability

ASUS Control Center is a new centralized IT management software from ASUS China. The software can monitor and control ASUS servers, workstations. A SQL injection vulnerability exists in ASUS Control Center v1.4.2.5. An attacker can exploit this vulnerability to inject SQL commands into specific A...

CVE-2022-26668

ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service...

CVE-2022-26669

ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data...

CVE-2022-26668

ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service...

Sql injection

ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data...