Skip to main content

Armoury Crate CVE-2023-26911

HIGH
Unquoted Search Path or Element (CWE-428)
2023-07-26 cve@mitre.org
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 26, 2023 - 14:15 nvd
HIGH 7.8

DescriptionNVD

ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.

AnalysisAI

ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-428. ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. Affected products include: Asus Armoury Crate, Asus Setupasusservices.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2026-8070 HIGH
7.3 May 29

Local privilege escalation in ASUS Armoury Crate allows an authenticated low-privileged user to bypass driver validation

CVE-2026-8918 HIGH
7.1 Jun 22

Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass

CVE-2026-16004 MEDIUM
5.9 Sep 08

Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a loca

CVE-2026-75809 MEDIUM
5.9 Sep 08

Insufficient access control on an exposed IOCTL interface in ASUS Armoury Crate allows a low-privileged local user to by

CVE-2026-16005 MEDIUM
5.8 Sep 08

Arbitrary memory freeing in the ASUS Armoury Crate kernel driver allows a local low-privileged user to trigger system cr

CVE-2026-75811 MEDIUM
5.8 Sep 08

Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver auth

CVE-2026-18023 MEDIUM
5.7 Sep 08

Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user

CVE-2026-16006 MEDIUM
5.7 Sep 08

Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass

CVE-2026-75808 MEDIUM
5.7 Sep 08

Memory exhaustion denial-of-service in ASUS Armoury Crate allows a local authenticated user to bypass the kernel-mode dr

CVE-2026-75810 MEDIUM
5.7 Sep 08

Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication a

CVE-2026-12962 MEDIUM
5.3 Sep 08

NTLM credential hash theft from Windows users running ASUS Armoury Crate is possible when a user visits an attacker-cont

CVE-2026-16003 LOW
2.0 Sep 08

The Armoury Crate kernel-mode driver on ASUS systems exposes an IOCTL interface without adequate caller verification, en

Share

CVE-2023-26911 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy