ASUS Control Center Express Agent CVE-2026-19397

Attacker must have adjacent-network access (same LAN, VLAN, or broadcast domain) to the target host - internet-based exploitation is not possible. The target host must have an active login session at the time of exploitation (AT:P); hosts at a locked screen or with no logged-in user may not satisfy the triggering condition. No attacker credentials or prior access to the managed environment are required. Exploitation is limited to the local network segment and to moments when a user session is active, which partially constrains automated mass-exploitation but is routinely satisfied in corporate workday environments.

The CVSS 4.0 score of 7.7 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately reflects the risk profile. The adjacent-network vector (AV:A) limits exposure to attackers on the same LAN, VLAN, or WiFi segment, excluding internet-facing exploitation. The AT:P (Attack Target Presence) metric is significant: exploitation requires an active login session on the target host, which constrains opportunistic automated exploitation but is a condition frequently met in corporate environments during business hours. The combination of PR:N (no attacker credentials needed) and full CIA impact on the vulnerable system makes this a severe threat within its network reach. No CISA KEV listing and no public POC are identified, suggesting no confirmed active exploitation at time of analysis. EPSS data was not provided. The realistic threat model is an insider or a compromised adjacent-network host pivoting to take over other managed endpoints via the agent.

An attacker positioned on the same LAN or WiFi segment as a managed host - for example, a malicious employee or a device compromised via phishing - identifies a machine running ASUS Control Center Express Agent with an active user session. The attacker directly connects to the agent's listening endpoint and invokes privileged control functions without supplying any credentials, achieving full remote control of the host including arbitrary command execution or configuration changes. No public exploit code is known at time of analysis, but the straightforward unauthenticated nature of the flaw makes development of exploitation tooling accessible.