Which versions of ASUS System Control Interface are affected by CVE-2026-13585?

ASUS System Control Interface driver v3 and earlier and ASUS Business Manager contain a high-severity vulnerability allowing local administrator users to access sensitive data from kernel memory or…

How to fix or mitigate CVE-2026-13585?

Within 24 hours, identify and inventory all systems running ASUS System Control Interface driver v3 and earlier, plus any ASUS Business Manager installations, documenting affected versions and the count of users with local administrator rights. Within 7 days, restrict local administrator account access to only essential personnel, enable detailed system event logging for driver activities, and deploy monitoring for unusual system resource consumption or unexpected system crashes. Within 30 days, monitor ASUS security advisories for patch availability and, upon release, conduct testing in a staging environment before phased production deployment, prioritizing business-critical systems.

ASUS System Control Interface CVE-2026-13585

Q: What is the CVSS score of CVE-2026-13585?

CVE-2026-13585 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44587 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-15 ASUS

GHSA-jf28-f99p-265w

Denial Of Service Business Manager System Control Interface System Control Interface V3 Asus

8.2

CVSS 4.0 · Vendor: ASUS

Severity by source

Vendor (ASUS) PRIMARY

8.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.0 MEDIUM

Local access with pre-existing administrator rights drives AV:L and PR:H; low complexity, and the flaw both discloses sensitive data (C:H) and enables host DoS (A:H) with no integrity impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ASUS).

CVSS VectorVendor: ASUS

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 02:31 vuln.today

CVE Published

Jul 15, 2026 - 02:01 cve.org

HIGH 8.2

DescriptionCVE.org

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

AnalysisAI

Local information disclosure and denial of service in the ASUS System Control Interface driver (v3 and earlier) and ASUS Business Manager lets a user already holding local administrator rights issue crafted IOCTL requests to read leftover sensitive data from kernel/driver buffers and, in severe cases, exhaust unthrottled resources to crash the host. The flaw stems from missing resource limits (CWE-770) combined with reuse of memory that still contains prior sensitive contents. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; ASUS self-reported and issued an advisory.

Technical ContextAI

The affected components are ASUS's endpoint management stack shipped on ASUS commercial/business notebooks: the System Control Interface (SCI) kernel-mode driver and the System Control Interface v3 driver, plus the ASUS Business Manager application (per CPE cpe:2.3:a:asus:system_control_interface_v3, cpe:2.3:a:asus:system_control_interface, and cpe:2.3:a:asus:business_manager). These drivers expose IOCTL device interfaces so user-mode software can query hardware/firmware state. The root cause is CWE-770, Allocation of Resources Without Limits and Throttling, allowing a caller to drive unbounded resource consumption, compounded by a sensitive-information-not-removed-before-reuse condition where a returned buffer still holds data from a previous allocation. Crafted IOCTL parameters cause the driver to return uninitialized/stale kernel buffer contents to the caller and/or to allocate resources without bound.

RemediationAI

Patch available per vendor advisory: update the ASUS System Control Interface / System Control Interface v3 driver and ASUS Business Manager to the fixed builds described in the 'Security Update for ASUS System Control Interface' section of the ASUS Security Advisory at https://www.asus.com/security-advisory/ (exact fixed version not provided in this dataset - obtain it from that advisory). Because exploitation requires local administrator rights, the most effective compensating control until patching is to tightly restrict and monitor local administrator membership on affected ASUS notebooks, since an admin is the only actor who can trigger the crafted IOCTL path. Where ASUS Business Manager and the SCI driver are not needed for fleet management, uninstalling or disabling those components removes the vulnerable IOCTL interface entirely (trade-off: loss of ASUS hardware-management and firmware-control features). Endpoint monitoring for anomalous IOCTL access to the SCI device object can serve as a detection control but does not prevent the issue.