CVE-2025-59373

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more information, please refer to section Security Update for MyASUS in the ASUS Security Advisory.

CVSS

No CVSS.

References

Link	Resource
https://www.asus.com/content/security-advisory/

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de escalada de privilegios local existe en el mecanismo de restauración de ASUS System Control Interface. Puede activarse cuando un actor sin privilegios copia archivos sin la validación adecuada en rutas de sistema protegidas, lo que podría llevar a la ejecución de archivos arbitrarios como SYSTEM. Para más información, consulte la sección Actualización de seguridad para MyAsus en el Aviso de Seguridad de ASUS.

Information

Published : 2025-11-25 02:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-59373

Mitre link : CVE-2025-59373

CVE.ORG link : CVE-2025-59373

JSON object : View

Products Affected

No product.

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2025-59373", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59373", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-25T14:36:06.135088Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "affectedData": [{"vendor": "ASUS", "product": "MyASUS", "versions": [{"status": "affected", "version": "0", "lessThan": "3.1.48.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-25T02:15:44.783", "references": [{"url": "https://www.asus.com/content/security-advisory/", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability exists in \n\n the restore mechanism of \n\nASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM.\nFor more information, please refer to section Security Update for MyASUS in the ASUS Security Advisory."}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios local existe en el mecanismo de restauraci\u00f3n de ASUS System Control Interface. Puede activarse cuando un actor sin privilegios copia archivos sin la validaci\u00f3n adecuada en rutas de sistema protegidas, lo que podr\u00eda llevar a la ejecuci\u00f3n de archivos arbitrarios como SYSTEM.\nPara m\u00e1s informaci\u00f3n, consulte la secci\u00f3n Actualizaci\u00f3n de seguridad para MyAsus en el Aviso de Seguridad de ASUS."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}