Asus One-Click Flaw Exposes Users to Remote Code Execution Attacks

Critical security vulnerability in ASUS DriverHub software has been discovered that allowed attackers to execute arbitrary code with administrator privileges through a simple web visit.

Security researcher identified and reported the vulnerability in April 2025, which has since been patched and assigned the CVE identifiers CVE-2025-3462 (8.4) and CVE-2025-3463 (9.4).

The exploit chain permitted attackers to compromise systems running the ASUS driver management utility through specially crafted domains that bypassed origin checking mechanisms.

The vulnerability originated in ASUS DriverHub, a background service automatically installed by certain ASUS motherboards that manages driver updates.

The researcher discovered that DriverHub implemented a local RPC (Remote Procedure Call) service listening on port 53000, which was designed to only accept communications from the official driverhub.asus.com website.

However, detailed investigation revealed a critical flaw in the origin validation mechanism.

This inadequate origin check meant that any website with a domain containing “driverhub.asus.com” could communicate with the local service and potentially trigger malicious operations.

“When I switched the origin to driverhub.asus.com.mrbruh.com, it allowed my request,” noted the researcher in their findings.

The vulnerability existed because the software performed a simple substring match rather than properly validating the domain structure, creating a dangerous security loophole for remote attackers.

Sophisticated Exploit Chain

The most dangerous aspect of the vulnerability was an “UpdateApp” endpoint discovered within DriverHub’s API that could download and execute files.

Through careful analysis of the source code, the researcher constructed an exploit chain that circumvented ASUS’s code signing requirements. The attack worked by:

1. Using the UpdateApp endpoint to download a malicious executable (which would fail ASUS’s signature check but remain on disk)
2. Downloading a modified configuration file (AsusSetup.ini) with customized “SilentInstallRun” parameters pointing to the malicious code.
3. Downloading a legitimate signed ASUS executable (AsusSetup.exe) that would read the modified configuration and execute the malicious program with administrator privileges

This chain effectively allowed any website with a matching subdomain pattern to achieve privileged code execution on vulnerable systems with just one click.

The vulnerability was particularly dangerous as it required no user interaction beyond visiting a malicious website.

Swift Patching Prevents Exploitation

After discovering the vulnerability on April 7, 2025, the researcher promptly reported it to ASUS the following day.

The company responded with a fixed version within ten days, which was verified by the researcher and confirmed live on April 18.

By May 9, 2025, the vulnerabilities received official CVE assignments, with CVE-2025-3463 receiving a critical 9.4 severity rating.

“After a month of waiting I am happy to say that my test domain is the only website that fits the regex, meaning it is unlikely that this was being actively exploited prior to my reporting of it,” the researcher stated, suggesting the vulnerability was not exploited in the wild before being patched.

Though ASUS does not offer monetary bug bounties, they acknowledged the researcher’s contribution by adding them to their security “hall of fame.

” Users of ASUS motherboards with DriverHub installed should ensure their software is updated to the latest version to protect against this vulnerability.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!