ZDI-26-657: ASUS Control Center Express Agent Missing Authentication Remote Code Execution Vulnerability

CVE-2026-19397 is a missing-authentication flaw (CWE-306) in the ASUS Control Center Express (ACE) Agent, the endpoint component of ASUS's fleet-management software. An unauthenticated user on the adjacent network segment can make a direct connection to the agent and take control of the host, but only while the host has an active login session. Because no credentials are required, the attacker gains full control of the machine — the CVSS 4.0 base score of 7.7 (High) rates confidentiality, integrity, and availability impact on the vulnerable host as High, and related coverage describes unauthenticated attackers obtaining root-level access. Organizations running the ACE Agent on managed ASUS endpoints are affected, particularly where the agent is reachable from untrusted LAN segments. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, EPSS is low (0.2% in 30 days), and ASUS has published a security update addressing it.

Do: Update the ASUS Control Center Express Agent to the fixed release listed in ASUS's 'Security Update for ASUS Control Center Express Agent' advisory. Until patched, restrict access to the agent's listening interface so only trusted management segments can reach it, since any unauthenticated user on the same network segment can connect. Inventory managed ASUS endpoints for the ACE Agent and confirm whether those hosts are routinely used with active login sessions, as exploitation requires one.