CVE-2025-15037CWE-732

An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver

Medium · published March 12, 2026

CVSS v4.0
6.8
EPSS
0%
Percentile
0.6
In the wild
Unconfirmed
What it is

An Incorrect

Permission Assignment vulnerability exists in the ASUS Business

System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a

specially crafted IOCTL request,

potentially leading to unauthorized access to sensitive hardware resources

and kernel information disclosure. Refer to the "ASUS Business System Control Interface" section on the ASUS Security Advisory for more information.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00094 · 0.6th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-03-12T02:00Z
EPSS history
Timeline
  • 12 MAR 02:00Z
    An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver
    cvelistv5