Driverhub CVE-2026-1880

Exploitation requires all of the following conditions to be present: (1) ASUS DriverHub installed on a Windows system (versions prior to 1.0.6.12), (2) attacker has local user account access to the system or the ability to write files in the DriverHub installation/cache directory, (3) the update validation resource files (checksum files, configuration scripts, or staging directories) are readable and writable by the local user account - a consequence of the CWE-367 improper permission assignment, (4) the local user must explicitly initiate or trigger a driver update through the DriverHub interface (automatic updates alone do not bypass the conditions), and (5) the system must allow execution of the modified resources with elevated privileges during the update process. Exploitation is limited to local authenticated users; remote attackers cannot exploit this vulnerability. The requirement for high attack complexity (AC:H) suggests that specific file system states, timing conditions, or system configurations may apply - the precise conditions are not detailed in the advisory, but likely involve the temporal window between validation and execution or specific deployment modes of the update mechanism.

CVSS vector AV:L/AC:H/PR:L/UI:P indicates local-only attack vector (not remotely exploitable), high attack complexity (specific conditions required), low privilege requirement (standard user), and requires user interaction (UI:P) - these factors substantially reduce real-world risk compared to the base score of 5.4. The attack requires the victim user to actively initiate or complete an update operation, creating a significant friction point for mass exploitation. AC:H (high complexity) suggests non-trivial prerequisites such as specific system states, file system conditions, or timing windows. No EPSS score, KEV listing, or public exploit data provided; absence of evidence suggests this vulnerability has not been actively exploited in the wild at scale. The privilege escalation impact (VC:H/VI:H/VA:H) is significant once exploited, but the prerequisite conditions (local access, standard user account, file modification capability, update trigger) collectively limit real-world attack surface to targeted scenarios - for instance, an attacker with physical or logical access to a user's workstation. Organizations running ASUS DriverHub on user-managed systems should prioritize patching, but the risk is substantially lower than remote unauthenticated vulnerabilities of equivalent CVSS score.

An attacker with local access to a user's system (via physical proximity, shared workstation, or compromised account) identifies that ASUS DriverHub is installed. The attacker locates the validation resource files (e.g., checksums, validation scripts) in the DriverHub directory, which are writable by the standard user due to improper permissions. The attacker modifies these resources to accept a malicious driver package or modifies a staging file containing the driver update. When the user opens DriverHub and clicks 'Check for Updates' or 'Install Updates,' the validation process checks the compromised resources (which now appear valid), and the malicious driver is executed with elevated privileges, granting the attacker system-level code execution.