ASUS Control Center Critical Flaw Allows Unauthenticated Attackers to Gain Root Access
ASUS patched CVE-2026-19397 (CVSS 7.7) in Control Center Express Agent, letting unauthenticated nearby attackers with an active session take over the host.
ASUS released version 1.7.24 of Control Center Express Agent to fix CVE-2026-19397, a CWE-306 missing-authentication flaw scored 7.7 on CVSS v4. Exploitation requires an active login session on the target and nearby network access, and agent compromise could lead to complete device takeover where the agent runs with elevated privileges. ASUS also issued a same-day advisory for Armory Crate covering ten additional CVEs.
- Flaw is CWE-306, missing authentication for a critical management function
- Exploitation requires an active login session and local or directly reachable network access
- No public exploit or confirmed real-world exploitation at disclosure time
- Defenders advised to patch, restrict agent network exposure and review telemetry
- Separate Armory Crate advisory covers ten CVEs up to version 6.5.7.0
- CVEs
- CVE-2026-19397CVE-2026-12962CVE-2026-18023CVE-2026-16003CVE-2026-16006CVE-2026-75808CVE-2026-75811
- Vendors
- ASUS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75811 | Local Hardware-Config Tampering in ASUS Armoury Crate | 5.8 group max | <1% | ||
| CVE-2026-19397 | Missing Authentication in ASUS Control Center Express Agent Allows Host Takeover | 7.7 | <1% |
From the original article
2 min read at gbhackers.com
ASUS has released a security update for the Control Center Express Agent to address CVE-2026-19397, a high-severity vulnerability related to missing authentication. This vulnerability allows an unauthenticated nearby attacker to potentially take control of an affected host through a direct connection to the agent. The issue affects versions before 1.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.