CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in information disclosure or data tampering, may cause GameSDK to become unavailable, and may also enable access to the victim’s information on other services. Refer to the ' Security Update for ASUS GameSDK ' section on the ASUS Security Advisory for more information.

CVSS

No CVSS.

References

Link	Resource
https://www.asus.com/security-advisory/

Configurations

No configuration.

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una política de seguridad de dominio cruzado permisiva con dominios no confiables en ASUS GameSDK permite a un usuario remoto obtener el hash NTLM de un usuario local al convencer al usuario de visitar una página web manipulada que envía una solicitud que contiene una ruta UNC al punto final del servicio local de la aplicación. Esto puede resultar en revelación de información o manipulación de datos, puede hacer que GameSDK deje de estar disponible y también puede permitir el acceso a la información de la víctima en otros servicios. Consulte la sección ’Security Update for ASUS GameSDK’ en el Aviso de Seguridad de ASUS para más información.

Information

Published : 2026-07-15 02:22

Updated : 2026-10-24 22:10

NVD link : CVE-2026-8919

Mitre link : CVE-2026-8919

CVE.ORG link : CVE-2026-8919

JSON object : View

Products Affected

No product.

CWE

CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

{"id": "CVE-2026-8919", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8919", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T12:34:07.016976Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "affectedData": [{"vendor": "ASUS", "product": "GameSDK", "versions": [{"status": "affected", "version": "through V1.0.5", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-15T02:22:57.653", "references": [{"url": "https://www.asus.com/security-advisory/", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "description": [{"lang": "en", "value": "CWE-942"}]}], "descriptions": [{"lang": "en", "value": "Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user\u2019s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application\u2019s local service endpoint. This can result in information disclosure or data tampering, may cause GameSDK to become unavailable, and may also enable access to the victim\u2019s information on other services.\nRefer to the '\u00a0Security Update for ASUS GameSDK\u00a0\u00a0' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Una pol\u00edtica de seguridad de dominio cruzado permisiva con dominios no confiables en ASUS GameSDK permite a un usuario remoto obtener el hash NTLM de un usuario local al convencer al usuario de visitar una p\u00e1gina web manipulada que env\u00eda una solicitud que contiene una ruta UNC al punto final del servicio local de la aplicaci\u00f3n. Esto puede resultar en revelaci\u00f3n de informaci\u00f3n o manipulaci\u00f3n de datos, puede hacer que GameSDK deje de estar disponible y tambi\u00e9n puede permitir el acceso a la informaci\u00f3n de la v\u00edctima en otros servicios.\nConsulte la secci\u00f3n \u2019Security Update for ASUS GameSDK\u2019 en el Aviso de Seguridad de ASUS para m\u00e1s informaci\u00f3n."}], "lastModified": "2026-10-24T22:10:00.210", "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}