ASUS Control Center CVE-2026-75754

Exploitation requires network reachability to the ASUS Control Center Enterprise (ACC) web service and TCP port 2222 on the ACC host; no authentication, credentials, or user interaction are needed against a default deployment (AV:N/AC:L/PR:N/UI:N). The full root outcome depends on the chained steps succeeding: the unauthenticated key-disclosure endpoint being exposed, the SSRF-reachable local service being able to enable SSH on 2222, and the hard-coded credentials being present (which they are, as a product-level flaw). The principal limiting factor is exposure - if the ACC console and port 2222 are segmented behind a VPN or management VLAN, an external attacker cannot reach the entry point; there is no version- or platform-specific gating beyond running an affected ACC Enterprise build.

This is a genuine top-priority issue, not a high-score-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack, and the vulnerable+subsequent impact metrics are all High - an accurate 10.0 given that the payoff is root on a fleet-management console. The chained nature (key disclosure → SSRF → SSH enablement → hard-coded login) is fully deterministic and highly automatable, so any operator that exposes ACC to reachable networks - even a mid-sized municipal IT team should treat this as urgent - must assume reliable exploitation once details or code circulate. Mitigating context is thin: EPSS is not provided, the CVE is not listed in CISA KEV, and no public exploit was identified at time of analysis, so exploitation is currently unproven in the wild but trivially weaponizable. The dominant residual uncertainty is deployment exposure (whether the ACC web interface is internet-facing or segmented), not exploit reliability; internet-facing consoles should be treated as imminently at risk.

An attacker who can reach the ACC web service - an internet-facing console or a foothold on the corporate LAN - sends an unauthenticated HTTP request that returns the instance encryption key, uses it to drive the SSRF-reachable function that switches on SSH at TCP/2222, then logs in with the appliance's hard-coded credentials to obtain a root shell. From there they pivot through ACC's management channels to push commands to every enrolled server and workstation, enabling data theft, ransomware staging, or estate-wide destruction. No public exploit is identified yet, but each step is deterministic and readily scriptable.