ZDI-26-657: ASUS Control Center Express Agent Missing Authentication Remote Code Execution Vulnerability
ZDI-26-657: ASUS Control Center Express Agent has an unauthenticated remote code execution flaw, CVE-2026-19397, rated CVSS 9.8.
The Zero Day Initiative published advisory ZDI-26-657 for ASUS Control Center Express Agent. The flaw, tracked as CVE-2026-19397, lets remote attackers execute arbitrary code without authentication. ZDI assigned a CVSS 9.8 rating. The advisory accompanies a vendor patch for affected installations.
- Unauthenticated remote code execution in ASUS Control Center Express Agent
- Tracked as CVE-2026-19397 with CVSS 9.8
- Disclosure coordinated by the Zero Day Initiative
- Vendor patch available for affected installations
- CVEs
- CVE-2026-19397
- Vendors
- ASUS
- Products
- Control Center Express Agent
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19397 | Missing Authentication in ASUS Control Center Express Agent Allows Host Takeover | 7.7 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ASUS Control Center Express Agent. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.