CVE-2026-12962

ASUS Armoury Crate, the bundled management software shipped with ASUS ROG/TUF motherboards, laptops and desktops, runs a local service whose endpoint accepts requests from untrusted web origins due to a permissive cross-domain security policy (CWE-942). An attacker triggers the flaw by convincing a logged-in Windows user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint, causing the system to authenticate to a resource of the attacker's choosing. The attacker obtains the local user's NTLM hash, which can be cracked offline or relayed to other services that accept NTLM authentication. Any Windows user running Armoury Crate on an ASUS system is affected; exploitation requires user interaction and results in credential disclosure rather than code execution. No public proof of concept is known, the flaw is not in CISA's KEV catalog, EPSS assigns a 0.4% probability of exploitation in the next 30 days, and ASUS scores it medium severity (CVSS 4.0: 5.3), so no active exploitation is currently known.

What to do: Apply the Armoury Crate update referenced in the 'Security Update for Armoury Crate App' section of the ASUS Security Advisory, using the Armoury Crate update/installer tool to confirm the installed version. As interim mitigations, block outbound SMB/UNC authentication to untrusted hosts and restrict NTLM usage via group policy or Windows firewall rules. Inventory Windows endpoints with Armoury Crate installed and prioritize systems where users browse the web under privileged credentials, since leaked NTLM hashes can be cracked or relayed.