ASUS System Control Interface CVE-2026-15029

Exploitation requires the attacker to already hold local administrator privileges on a machine where the ASUS System Control Interface v3, legacy System Control Interface, or ASUS Business Manager driver is installed and loaded, and to send specially crafted IOCTL requests to that driver's device object. The exact prerequisite is the presence of the vulnerable ASUS kernel driver plus the ability to open its device handle (available to administrators) - no remote access, no user interaction, and no non-default configuration are needed beyond having the ASUS management software installed. Limiting factors: the PR:H requirement means a non-admin user cannot exploit this, the vector is strictly local (AV:L) so there is no network path, and only ASUS notebook platforms carrying these specific utilities are in scope, which narrows the affected population to ASUS commercial/business fleets.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, base 8.4 High) is internally consistent with the description: local vector, low complexity, but high privileges required - the attacker must already be a local administrator. This significantly bounds real-world risk: this is a privilege-escalation/protection-bypass primitive (admin to kernel), not a remote or unauthenticated compromise, so it is not a mass-exploitation candidate. The primary value to an attacker is post-compromise - converting admin into full kernel read/write for EDR tampering, credential theft from kernel memory, or persistence. It is not in CISA KEV and no POC was provided, so there is no confirmed active exploitation; EPSS was not supplied but would be expected to be low given the local, high-privilege prerequisite. The 'Authentication Bypass' tag in the input conflicts with the actual mechanism (memory-protection bypass, not auth bypass) and with PR:H - treat that tag as loose vendor labeling, not evidence of unauthenticated access. Overall: a legitimate hardening priority on ASUS commercial fleets, but lower urgency than any network-reachable or PR:N flaw.

An attacker who has already gained local administrator rights on an ASUS commercial notebook - via phishing, a prior exploit, or a malicious insider - opens the ASUS System Control Interface driver's device handle and sends crafted IOCTL requests specifying attacker-chosen physical addresses. Using the resulting kernel-grade read/write primitive, they patch kernel structures to disable EDR, escalate to SYSTEM/kernel, or read sensitive memory. No public POC is currently identified, and the low attack complexity means exploitation is straightforward once admin access is held.