EUVD-2026-41483
GHSA-2844-p28c-wcj6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local authenticated low-priv user (AV:L/PR:L) sends a low-complexity tampered IPC message (AC:L) to gain SYSTEM, yielding full C/I/A impact with no scope change.
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
Lifecycle Timeline
1DescriptionCVE.org
External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.
AnalysisAI
Local privilege escalation to SYSTEM in ASUS Business Manager lets a low-privileged local user run arbitrary code by tampering with an inter-process communication (IPC) message that the software's privileged service trusts. Because the SYSTEM-level component controls a file name or path based on attacker-influenced IPC input (CWE-73), a standard user can coerce it into loading or executing attacker-chosen content. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV; ASUS is the reporter and has issued a security advisory.
Technical ContextAI
ASUS Business Manager is a Windows endpoint management/utility suite that ships a privileged background service running as SYSTEM and communicating with a lower-privileged client over a local IPC channel (named pipe, local socket, or similar). The root cause is CWE-73 (External Control of File Name or Path): the privileged endpoint derives a file name or path from data received in an IPC message without adequately validating the sender or constraining the path to a safe location. An attacker who crafts or replays a tampered IPC message therefore dictates which file the SYSTEM process opens, writes, or executes, yielding code execution in the service's security context. The single affected CPE is cpe:2.3:a:asus:asus_business_manager:*:*:*:*:*:*:*:* - a locally installed Windows application, not a network service.
RemediationAI
Update ASUS Business Manager to the fixed release listed under the 'Security Update for ASUS Business Manager' section of the ASUS Security Advisory (https://www.asus.com/security-advisory); the input does not include an exact fixed version, so obtain it directly from that advisory rather than assuming a build (No vendor-released fixed version independently confirmed from available data). Because exploitation requires an authenticated local user, effective interim compensating controls are to restrict interactive and local logon rights on affected machines to trusted administrators only, remove non-essential standard-user accounts from shared endpoints, and - if the software is not business-critical - stop and disable the privileged ASUS Business Manager service until patched, accepting loss of its management functionality as the trade-off. Monitoring the local IPC endpoint and the service's file-access activity with EDR can help detect tampering attempts in the interim.
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today