ASUS System Control Interface CVE-2026-13585

Exploitation requires local administrator privileges on the target ASUS system (CVSS PR:H) and local access (AV:L) - it cannot be performed remotely or by a standard/unprivileged user. The specific prerequisite is that the vulnerable ASUS System Control Interface driver (or v3 driver) and/or ASUS Business Manager be installed and their IOCTL device interface reachable, which is the default on ASUS commercial/business notebooks shipping with this management stack. The attacker must craft malformed IOCTL requests to the driver; no user interaction (UI:N) and no special attack requirement (AT:N) are needed once admin access and the driver are present. Limiting factors: the administrator-privilege requirement sharply narrows the realistic threat to insiders, malware already running elevated, or post-compromise scenarios, and systems without the SCI driver / Business Manager installed are not exposed.

The vendor CVSS 4.0 base score is 8.2 (High) with vector AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:H, meaning local access, low complexity, but high privileges (administrator) already required - a significant limiting factor. The high headline score is driven by availability impact (VA:H/SA:H) and subsequent-system confidentiality (SC:H), not by remote reach. No EPSS score, KEV entry, POC, or SSVC decision was provided, so exploitation-probability signals are absent; the realistic priority is moderate rather than urgent because a local administrator is a high bar and admins can already disrupt a single machine through legitimate means. The notable residual risk is the confidentiality/DoS combination on managed fleets. Note a tension worth verifying: the description explicitly says the primary consequence is disclosure of sensitive information, yet the CVSS marks vulnerable-system confidentiality VC:N and places confidentiality only on the subsequent system (SC:H) - confirm with the ASUS advisory which data boundary is actually crossed.

An attacker who has already obtained local administrator privileges on an ASUS business notebook - for example after an earlier phishing-plus-privilege-escalation foothold - sends crafted IOCTL requests to the System Control Interface driver to read back stale buffer contents containing sensitive data, then repeats malformed requests to exhaust driver resources and crash the machine. No public POC is known, and low attack complexity means a knowledgeable admin-level attacker could develop one against the driver's IOCTL interface.