CVE-2025-12793

An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location, potentially resulting in arbitrary code execution. Refer to the ' Security Update for MyASUS' section on the ASUS Security Advisory for more information.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.asus.com/security-advisory	Vendor Advisory
https://www.asus.com/security-advisory	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:asus:myasus:::::::x64:*
	cpe:2.3:a:asus:myasus:::::::arm64:*

History

17 Jun 2026, 08:32

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de ruta de carga de DLL no controlada en AsusSoftwareManagerAgent. Un atacante local puede influir en la aplicación para que cargue una DLL desde una ubicación controlada por el atacante, lo que podría resultar en ejecución de código arbitrario. Consulte la sección 'Security Update for MyASUS' en el Aviso de Seguridad de ASUS para más información.

28 Jan 2026, 14:50

Type	Values Removed	Values Added
CPE		cpe:2.3:a:asus:myasus:::::::x64:* cpe:2.3:a:asus:myasus:::::::arm64:*
First Time		Asus Asus myasus
References	~~() https://www.asus.com/security-advisory -~~	() https://www.asus.com/security-advisory - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

06 Jan 2026, 19:15

Type	Values Removed	Values Added
References	~~() https://www.asus.com/security-advisory -~~	() https://www.asus.com/security-advisory -

06 Jan 2026, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-06 03:15

Updated : 2026-06-17 08:32

NVD link : CVE-2025-12793

Mitre link : CVE-2025-12793

CVE.ORG link : CVE-2025-12793

JSON object : View

Products Affected

asus

myasus

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2025-12793", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12793", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-06T14:20:04.567403Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "affectedData": [{"vendor": "ASUS", "product": "ASCI", "versions": [{"status": "affected", "version": "Before v3.1.49.0"}, {"status": "affected", "version": "Before v1.1.37.0"}], "platforms": ["64 bit"], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "ASCI", "versions": [{"status": "affected", "version": "Before v3.2.50.0"}], "platforms": ["ARM"], "defaultStatus": "unaffected"}]}], "published": "2026-01-06T03:15:41.120", "references": [{"url": "https://www.asus.com/security-advisory", "tags": ["Vendor Advisory"], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}, {"url": "https://www.asus.com/security-advisory", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location, potentially resulting in arbitrary code execution.\nRefer to the '\n\nSecurity Update for MyASUS' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Existe una vulnerabilidad de ruta de carga de DLL no controlada en AsusSoftwareManagerAgent. Un atacante local puede influir en la aplicaci\u00f3n para que cargue una DLL desde una ubicaci\u00f3n controlada por el atacante, lo que podr\u00eda resultar en ejecuci\u00f3n de c\u00f3digo arbitrario.\nConsulte la secci\u00f3n 'Security Update for MyASUS' en el Aviso de Seguridad de ASUS para m\u00e1s informaci\u00f3n."}], "lastModified": "2026-06-17T08:32:58.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asus:myasus:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "B272677A-2AF9-4ECE-92E6-393C1227AF78", "versionEndExcluding": "4.0.52.0"}, {"criteria": "cpe:2.3:a:asus:myasus:*:*:*:*:*:*:arm64:*", "vulnerable": true, "matchCriteriaId": "1C177A8B-ED83-42D0-914E-90CF89FBA787", "versionEndExcluding": "4.2.50.0"}], "operator": "OR"}]}], "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}