CVE-2026-75809

Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

CVSS

No CVSS.

References

Link	Resource
https://www.asus.com/security-advisory

Configurations

No configuration.

History

28 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) IOCTL expuesto con control de acceso insuficiente en ASUS Armoury Crate permite a un usuario local divulgar información y deshabilitar la funcionalidad del dispositivo al eludir la autenticación del controlador y utilizar IOCTLs para leer y escribir en el espacio de configuración PCIe. Consulte la sección 'Security Update for Armoury Crate App' en el Aviso de Seguridad de ASUS para más información.

Information

Published : 2026-09-08 03:17

Updated : 2026-09-28 23:10

NVD link : CVE-2026-75809

Mitre link : CVE-2026-75809

CVE.ORG link : CVE-2026-75809

JSON object : View

Products Affected

No product.

CWE

CWE-782

Exposed IOCTL with Insufficient Access Control

{"id": "CVE-2026-75809", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75809", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T12:41:26.913442Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "affectedData": [{"vendor": "ASUS", "product": "Armoury Crate", "versions": [{"status": "affected", "version": "through 6.5.7", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-08T03:17:18.763", "references": [{"url": "https://www.asus.com/security-advisory", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "description": [{"lang": "en", "value": "CWE-782"}]}], "descriptions": [{"lang": "en", "value": "Exposed IOCTL with insufficient access control in ASUS\u00a0Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the '\nSecurity Update for Armoury Crate App\u00a0' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "IOCTL expuesto con control de acceso insuficiente en ASUS Armoury Crate permite a un usuario local divulgar informaci\u00f3n y deshabilitar la funcionalidad del dispositivo al eludir la autenticaci\u00f3n del controlador y utilizar IOCTLs para leer y escribir en el espacio de configuraci\u00f3n PCIe. Consulte la secci\u00f3n 'Security Update for Armoury Crate App' en el Aviso de Seguridad de ASUS para m\u00e1s informaci\u00f3n."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}