ASUS System Control Interface CVE-2026-15030

Q: What is the CVSS score of CVE-2026-15030?

CVE-2026-15030 has a CVSS 4.0 base score of 5.6 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44588 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-15 ASUS

GHSA-ccmx-85ff-f67h

Buffer Overflow Information Disclosure Business Manager System Control Interface System Control Interface V3 Asus

5.6

CVSS 4.0 · Vendor: ASUS

Severity by source

Vendor (ASUS) PRIMARY

5.6 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.1 MEDIUM

Local access and admin privileges required to reach the IOCTL interface; AC:H reflects non-trivial validation bypass; impact is read-only memory disclosure with no integrity or availability effect.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ASUS).

CVSS VectorVendor: ASUS

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 02:33 vuln.today

DescriptionCVE.org

Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request that bypasses the validation. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

AnalysisAI

Out-of-bounds memory read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager exposes kernel and firmware memory contents to local administrators via a crafted IOCTL request that bypasses the driver's length validation. The vulnerability (CWE-125) is constrained to AV:L/PR:H, meaning exploitation requires prior establishment of local administrator access on a system where the affected ASUS software is installed. No public exploit code or active exploitation has been confirmed at time of analysis; the ASUS Security Advisory documents the remediation path.

Technical ContextAI

The root cause is CWE-125 (Out-of-bounds Read): the kernel-mode driver component of the affected ASUS software fails to adequately validate the length or offset parameters supplied in an IOCTL (Input/Output Control) request before reading from a firmware-mapped memory buffer. IOCTL is the standard Windows mechanism for user-mode applications to invoke privileged operations inside a kernel driver. When the driver processes a crafted IOCTL with manipulated parameters, it reads beyond the intended firmware buffer boundary, disclosing adjacent memory regions that may contain sensitive kernel data, credentials, or firmware internals. Three distinct ASUS products share the vulnerable IOCTL handling code: System Control Interface v3 (cpe:2.3:a:asus:system_control_interface_v3), System Control Interface (cpe:2.3:a:asus:system_control_interface), and Business Manager (cpe:2.3:a:asus:business_manager). These are hardware management layers typically found on ASUS commercial or enterprise-class systems.

RemediationAI

Apply the vendor-supplied update documented in the ASUS Security Advisory (https://www.asus.com/security-advisory, 'Security Update for ASUS System Control Interface' section). Patch availability is confirmed per vendor advisory; the exact fixed version number is not independently specified in the available intelligence and must be verified directly from the advisory before deployment. As compensating controls pending patching: restrict interactive and remote login to affected systems to only operationally necessary administrator accounts, reducing the pool of principals capable of issuing IOCTL requests. Audit the installed footprint of ASUS System Control Interface and Business Manager across the estate and uninstall from systems that do not require hardware management functions - each removal eliminates the vulnerable driver entirely. Applying Windows Credential Guard or Secure Boot attestation does not mitigate this specific read primitive but limits the value of any firmware secrets an attacker might extract. There are no known functional side effects to uninstalling the software on systems where it is not actively used.