ASUS Motherboards CVE-2025-11901

Exploitation requires local physical access to the machine's internals: the attacker must open the chassis and install a specially crafted device into an internal expansion (PCIe/expansion) slot AND run a supporting software utility on the host. It is limited to ASUS motherboards using the specified Intel chipset families (B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680). Key limiting factors: no remote or network path exists (AV:P), so the attacker needs hands-on, unsupervised physical access plus the ability to install hardware and execute the accompanying utility - making this realistic only against unattended, kiosk, or physically compromised systems.

This is a HIGH-CVSS-but-LOW-real-world-risk issue. The CVSS 4.0 base score of 7.0 is driven entirely by high vulnerable-system impact (VC:H/VI:H/VA:H) reflecting the DMA read/write potential, but the attack vector is Physical (AV:P) - the single most limiting metric. EPSS is very low at 0.23% (12th percentile), consistent with the physical prerequisite: mass or remote exploitation is not feasible. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - high technical impact but negligible probability of widespread exploitation because an attacker must physically open the chassis, install a crafted device into an internal expansion (PCIe) slot, and run a supporting software utility. The CWE mapping is questionable: the CVE is labeled CWE-284 (Improper Access Control) yet the description describes uncontrolled resource consumption leading to DMA risk, which aligns more with CWE-400/CWE-1189 - verify with vendor. Bottom line: prioritize only for high-security physical environments (kiosks, unattended workstations, hardware in hostile custody); for typical deployments this is a low operational priority.

An attacker with physical access to a machine opens the chassis and installs a specially crafted hardware device into an internal expansion slot, then runs an accompanying software utility. The malicious device triggers uncontrolled resource consumption that raises the risk of unauthorized direct memory access (DMA), potentially exposing or corrupting system memory. No public exploit code is known, and the entire chain depends on physical, hands-on access to the internal hardware.