{"id":"CVE-2025-15037","aliases":["EUVD-2025-208607","GHSA-jv98-ppxj-hj8j"],"status":"published","title":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control...","description":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a\nspecially crafted IOCTL request,\npotentially leading to unauthorized access to sensitive hardware resources\nand kernel information disclosure. Refer to the \"ASUS Business System Control Interface\" section on the ASUS Security Advisory for more information.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00105,"percentile":0.01088,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732"],"published":"2026-03-12T02:00:20Z","modified":"2026-06-17T08:36:59Z","products":[{"vendor":"asus","product":"asus business system control interface"}],"references":[{"url":"https://www.asus.com/content/security-advisory/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15037"},{"url":"https://www.asus.com/content/security-advisory"},{"url":"https://github.com/advisories/GHSA-jv98-ppxj-hj8j"}],"sources":{"cve":[{"id":"CVE-2025-15037","description":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a\nspecially crafted IOCTL request,\npotentially leading to unauthorized access to sensitive hardware resources\nand kernel information disclosure. Refer to the \"ASUS Business System Control Interface\" section on the ASUS Security Advisory for more information.","status":"published","published":"2026-03-12T02:00:20.964Z","modified":"2026-03-12T13:15:55.928Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-208607","description":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a\nspecially crafted IOCTL request,\npotentially leading to unauthorized access to sensitive hardware resources\nand kernel information disclosure. Refer to the \"ASUS Business System Control Interface\" section on the ASUS Security Advisory for more information.","status":"published","published":"2026-03-12T02:00:20Z","modified":"2026-03-12T13:15:55Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:36.272941Z"}],"ghsa":[{"id":"GHSA-jv98-ppxj-hj8j","title":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control...","description":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a\nspecially crafted IOCTL request,\npotentially leading to unauthorized access to sensitive hardware resources\nand kernel information disclosure. Refer to the \"ASUS Business System Control Interface\" section on the ASUS Security Advisory for more information.","status":"published","published":"2026-03-12T03:31:06Z","modified":"2026-03-12T03:31:06Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:06:35.141921Z"}],"nvd":[{"id":"CVE-2025-15037","description":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a\nspecially crafted IOCTL request,\npotentially leading to unauthorized access to sensitive hardware resources\nand kernel information disclosure. Refer to the \"ASUS Business System Control Interface\" section on the ASUS Security Advisory for more information.","status":"published","published":"2026-03-12T03:15:56.353Z","modified":"2026-06-17T08:36:59.57Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:12:01.641503Z"}]}}