Privilege Escalation Vulnerability in ASUS Member Center

CVE-2026-3428

What is CVE-2026-3428?

A vulnerability in the update modules of ASUS Member Center enables local users to escalate their privileges to Administrator. This is achieved through a Time-of-check Time-of-use (TOC-TOU) exploit during the update process, where an attacker can substitute a malicious payload for a legitimate file immediately after it's downloaded. If the user consents to the update, the malicious code is executed with elevated privileges, creating potential security risks. For more details, refer to the ASUS Security Advisory.

References