Armoury Crate EUVD-2026-72626

The target machine must have ASUS Armoury Crate installed with its local HTTP service running, which is the default state on ASUS gaming PCs, laptops, and systems with ASUS motherboards that ship with Armoury Crate. The single required user interaction is visiting the attacker-controlled web page in a browser (UI:P). The attack succeeds against default Windows configurations that support NTLM authentication, which covers the vast majority of Windows installations including those joined to Active Directory domains. The attacker must operate a reachable SMB server on TCP 445 to capture the transmitted NTLMv2 hash; an internet-accessible server is required for remote exploitation, while a LAN-side server suffices for internal or post-phishing attacks. Outbound SMB blocking at the network perimeter limits remote hash capture but does not prevent attacks where the SMB listener is on the same network segment. No administrative privileges, special application configuration, or non-default Armoury Crate settings are required beyond the default installation state.

The vendor-provided CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P, SC:L) reflects the user-interaction prerequisite and the indirect nature of the impact - the hash does not immediately compromise the system and requires either offline cracking or an NTLM relay step. However, this score likely understates real-world risk: NTLMv2 hashes are routinely cracked offline using GPU-accelerated tools on weak or common passwords, and pass-the-hash techniques enable lateral movement without cracking at all. Attack complexity is genuinely low (AC:L, AT:N) once the phishing lure reaches the user, and exploitation is fully automatable against any visitor to the malicious page. Even a mid-sized municipal IT team in gniezno, where ASUS gaming hardware may appear in mixed-use or hybrid-work environments alongside Active Directory infrastructure, would face meaningful lateral-movement risk from a single captured hash if NTLM fallback authentication remains enabled - as it does by default in most Windows domain configurations. No EPSS score was provided in the input data. Neither KEV listing nor public proof-of-concept was identified at time of analysis; exploitation probability is moderate, elevated primarily by the low attack complexity and the near-ubiquity of NTLM in Windows environments.

An attacker hosts a malicious web page containing JavaScript that issues a cross-origin XMLHttpRequest to the Armoury Crate local service endpoint, embedding a UNC path (e.g., \\attacker-smb.example\lure) pointing to an internet-accessible SMB server running Responder or Impacket's ntlmrelayx. The target user is directed to the page via a phishing link; on page load the browser makes the request, the permissive CORS policy allows it, the Armoury Crate service processes the path, and Windows automatically sends the user's NTLMv2 hash to the attacker's server - all without additional user interaction beyond visiting the page. No public proof-of-concept has been identified, though the underlying UNC-path NTLM coercion technique via CORS-permissive localhost services is publicly documented in offensive security literature.