ASUS Motherboards CVE-2026-93495

Requires physical proximity and the ability to insert a specially crafted hardware device into one of the affected ASUS motherboards (Prime Z390-A, Prime Z390-A/H10, ROG Maximus XI Hero/Hero Wi-Fi/Formula/Code/Extreme/Apex/Gene, ROG Strix Z390-E/F Gaming, Pro WS C246 ACE, WS Z390 Pro). The root cause is improper initialization (CWE-665) of a memory-access interface that fails to restrict the inserted device's DMA/memory access. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and complexity is low (AC:L). The decisive limiting factor is AV:P - the attack is impossible remotely or over a network and demands hands-on access to the specific hardware, confining realistic exploitation to evil-maid, supply-chain, repair, or shared-physical-access scenarios.

This is a genuinely high-impact but tightly-gated hardware flaw. The CVSS 4.0 vector (AV:P/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) scores 7.0 and reflects the central tension: the technical impact is severe - arbitrary memory read AND write, i.e. full confidentiality and integrity compromise (likely DMA-class, enabling secret extraction, secure-boot/credential bypass, or persistent implant) - but the attack vector is Physical (AV:P), which is the single strongest limiting factor. An attacker must be physically present to insert a specially crafted device. There is no EPSS score, no CISA KEV listing, and no public exploit (POC) identified in the provided data, so by the precision rules the exploitation status is 'no public exploit identified at time of analysis.' SSVC data is not provided. The combination of PR:N/AC:L (no credentials, low complexity once physical access is achieved) means that in evil-maid, supply-chain, repair-shop, or shared-workstation scenarios this is realistically exploitable, but it cannot be exploited remotely or at scale. Net assessment: a real priority for high-security endpoints and physically exposed machines, but low urgency for the general fleet versus a remote RCE - the AV:P gate, not the raw impact, should drive patch prioritization. Note the 'Information Disclosure' tag understates impact, since the flaw also permits arbitrary memory WRITE (integrity).

An attacker with brief physical access to a powered or bootable ASUS Z390-generation motherboard (e.g. an unattended ROG Maximus XI workstation, an 'evil maid' hotel scenario, or a device intercepted in the supply/repair chain) inserts a specially crafted peripheral device. Due to improper initialization (CWE-665) of a memory-access interface, the device is granted arbitrary read/write to system memory, allowing extraction of encryption keys/credentials or implantation of persistent malicious code. No public exploit code is identified at time of analysis, and the attack requires low complexity but genuine physical proximity.