Member Center EUVD-2026-23158

Local file-system write access is required; the attacker must be able to monitor and modify files in the update directory (typically %LocalAppData%\ASUS or %ProgramData%\ASUS depending on update mode). An authenticated local user account is mandatory (CVSS PR:L), though this is a low barrier on shared or minimally-secured systems. The attacker must execute the race condition during an active update process, either by triggering a manual update or waiting for an automatic update. User consent to an elevation prompt is required (CVSS UI:P), which is typically granted automatically or with minimal thought when the system indicates a routine security update is ready to install. The vulnerability is NOT present on systems running ASUS Member Center version 1.6.6.5 or later, or on systems where write permissions to the update cache directory are restricted to SYSTEM/ADMINISTRATOR accounts only. No special configuration or non-default settings are required; default installations are vulnerable.

This vulnerability presents moderate-to-high real-world risk despite the 5.4 CVSS score, which accurately reflects technical mitigations (local access required, AC:H indicating timing complexity, user interaction required) that reduce the baseline attack surface compared to remote exploits. However, several signals elevate practical risk: (1) TOCTOU vulnerabilities, while complex to exploit, become reliable when automated tools assist in winning the race; (2) the target application (ASUS Member Center) is pre-installed on millions of ASUS systems, creating large attack surface; (3) the attack chain requires no network access, reducing defensive chokepoints; (4) privilege escalation to Administrator from an authenticated local user account is a valuable stepping stone in multi-stage attacks (e.g., malware installation, lateral movement). CVSS vector AT:P (race condition timing) and AC:H (requires specific timing/file-system conditions) correctly reflect the difficulty, but successful exploitation is achievable through automation. No EPSS score, active exploitation status (KEV), or public POC are confirmed in provided data; if this vulnerability were being actively exploited in the wild, real-world risk would shift significantly higher. Risk assessment is currently MODERATE for defender priority: patch before updating ASUS Member Center on shared or untrusted systems, but this is not an emergency zero-day requiring immediate shutdown.

A local unprivileged user on an ASUS laptop obtains an authenticated account (e.g., through shared family computer or initial breach of a guest account). When the user initiates a manual update via ASUS Member Center or the update daemon triggers an automatic update cycle, the attacker monitors the file system for the downloaded update file. Immediately after the integrity check completes but before execution begins (a window typically measurable in milliseconds to seconds, but reliably detectable and exploitable with file-system monitoring tools), the attacker replaces the legitimate update executable with a malicious payload using low-level file operations or symbolic link attacks. The user consents to the elevation prompt (required for administrative privilege elevation), and the system executes the attacker's code with full Administrator privileges, giving the attacker persistent administrative access to the system.