Insufficient Access Control in ASUS System Control Interface Exploits Local System Vulnerability
CVE-2026-112116

8.5HIGH

Key Information:

Vendor

Asus
Status
System Control Interface
Vendor
CVE Published:
4 November 2026

What is CVE-2026-112116?

An insufficient access control vulnerability in the ASUS System Control Interface permits local, low-privileged users to execute crafted device control requests. This exploitation can lead to unauthorized access, enabling users to read and write arbitrary physical memory. The implications of this vulnerability can compromise system integrity significantly. For comprehensive details, please visit the ASUS Security Advisory.

Affected Version(s)

System Control Interface 3.1.66.0 <= 3.1.69.0

References

https://www.asus.com/security-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alperen GECE (@alperensiz)
.