EUVD-2026-72626
GHSA-4xp6-hxc2-9436
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NTLM credential material represents full account compromise potential (C:H); scope changes from the application to the Windows authentication subsystem; user must visit the malicious page (UI:R).
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
Lifecycle Timeline
1DescriptionCVE.org
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
AnalysisAI
NTLM credential hash theft from Windows users running ASUS Armoury Crate is possible when a user visits an attacker-controlled web page that exploits the application's permissive cross-domain (CORS) policy. The local Armoury Crate service accepts cross-origin requests from untrusted web origins, allowing malicious JavaScript to inject a UNC path into a service call; Windows then automatically initiates SMB authentication to the attacker's server, transmitting the user's NTLMv2 hash without further interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target machine must have ASUS Armoury Crate installed with its local HTTP service running, which is the default state on ASUS gaming PCs, laptops, and systems with ASUS motherboards that ship with Armoury Crate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P, SC:L) reflects the user-interaction prerequisite and the indirect nature of the impact - the hash does not immediately compromise the system and requires either offline cracking or an NTLM relay step. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Armoury Crate to the patched release identified in the ASUS Security Advisory at https://www.asus.com/security-advisory under the 'Security Update for Armoury Crate App' section; the exact fixed version number is not present in the available input data and must be retrieved directly from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cors Misconfiguration
View allCross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` co
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today