CVE-2022-36438

Vulnerability

AsusSwitch.exe, a component of ASUS System Control Interface on ASUS personal computers running Windows, sets weak file permissions. This affects ASUS System Control Interface 3 before version 3.1.5.0 and AsusSwitch.exe before version 1.0.10.0. [1]

Exploitation

An attacker with local access to the system can exploit the weak permissions to modify or replace the executable or its associated files. No additional authentication is required beyond local user access. The attacker can leverage the weak permissions to escalate privileges or delete system files arbitrarily.

Impact

Successful exploitation allows local privilege escalation, enabling the attacker to gain higher-level access. Additionally, the attacker can delete files anywhere on the system, leading to denial of service or system instability.

Mitigation

ASUS released fixed versions: ASUS System Control Interface 3.1.5.0 and AsusSwitch.exe 1.0.10.0. Users should update via ASUS official channels. No workaround is documented. The vulnerability is not listed on CISA KEV as of publication.