CVE-2026-7480

An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary code via a crafted RPC call that bypass the validation mechanism. Refer to the 'Security Update for ASUS System Control Interface' section on the ASUS Security Advisory for more information.

CVSS

No CVSS.

References

Link	Resource
https://www.asus.com/security-advisory/

Configurations

No configuration.

History

21 Jul 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Asignación Incorrecta de Permisos para Recurso Crítico en la Interfaz de Control del Sistema de ASUS permite a un usuario local elevar privilegios a SYSTEM y ejecutar código arbitrario a través de una llamada RPC manipulada que omite el mecanismo de validación. Consulte la sección 'Actualización de Seguridad para la Interfaz de Control del Sistema de ASUS' en el Aviso de Seguridad de ASUS para más información.

29 May 2026, 02:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 02:16

Updated : 2026-07-21 12:10

NVD link : CVE-2026-7480

Mitre link : CVE-2026-7480

CVE.ORG link : CVE-2026-7480

JSON object : View

Products Affected

No product.

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-7480", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7480", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T16:23:54.421716Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "affectedData": [{"vendor": "ASUS", "product": "ASUS System Control Interface", "versions": [{"status": "affected", "version": "3.1.59.0 and earlier"}], "platforms": ["64 bit"], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "ASUS System Control Interface", "versions": [{"status": "affected", "version": "3.2.60.0 and earlier"}], "platforms": ["ARM"], "defaultStatus": "unaffected"}]}], "published": "2026-05-29T02:16:17.223", "references": [{"url": "https://www.asus.com/security-advisory/", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary code via a crafted RPC call that bypass the validation mechanism.\nRefer to the 'Security Update for ASUS System Control Interface' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Una vulnerabilidad de Asignaci\u00f3n Incorrecta de Permisos para Recurso Cr\u00edtico en la Interfaz de Control del Sistema de ASUS permite a un usuario local elevar privilegios a SYSTEM y ejecutar c\u00f3digo arbitrario a trav\u00e9s de una llamada RPC manipulada que omite el mecanismo de validaci\u00f3n.\nConsulte la secci\u00f3n 'Actualizaci\u00f3n de Seguridad para la Interfaz de Control del Sistema de ASUS' en el Aviso de Seguridad de ASUS para m\u00e1s informaci\u00f3n."}], "lastModified": "2026-07-21T12:10:00.090", "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}