CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5716 – ASUS Armoury Crate - Arbitrary File Write
https://notcve.org/view.php?id=CVE-2023-5716
ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP requests without permission. ASUS Armory Crate tiene una vulnerabilidad en la escritura de archivos arbitrarios y permite a atacantes remotos acceder o modificar archivos arbitrarios enviando solicitudes HTTP específicas sin permiso. • https://www.twcert.org.tw/tw/cp-132-7666-fffce-1.html • CWE-306: Missing Authentication for Critical Function CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-26911
https://notcve.org/view.php?id=CVE-2023-26911
ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. • http://asus.com http://setupasusservices.com https://irradiate.com.au/blog/CVE-2023-26911 • CWE-428: Unquoted Search Path or Element •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42455
https://notcve.org/view.php?id=CVE-2022-42455
ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges. • https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0003.md •