Critical ASUS Control Center Flaw Grants Full Admin Access
A critical vulnerability (CVE-2026-75754) in ASUS Control Center Enterprise allows remote attackers to gain complete administrative control over managed systems.
ASUS has released an urgent security update to address a critical vulnerability, CVE-2026-75754, found in its Control Center Enterprise (ACC) software. This flaw, rated with a maximum CVSS score of 10.0, enables remote attackers to achieve full administrative control over the platform and all connected devices without requiring any authentication or user interaction.
The vulnerability is a result of a chain of three interconnected weaknesses. Firstly, a critical function within ASUS Control Center is missing authentication, allowing unauthorized access to sensitive operations over the network. This is compounded by a server-side request forgery (SSRF) vulnerability, which attackers can exploit to trick the system into revealing its encryption key.
Once the encryption key is obtained, a local service on the host automatically initiates an SSH listener on TCP port 2222. This effectively creates a hidden backdoor into the compromised machine. The final and most critical element of the exploit chain involves hard-coded credentials embedded within the ASUS Control Center software itself.
Attackers who successfully retrieve the encryption key can leverage these hard-coded credentials to log directly into the newly opened SSH port. This grants them a full root shell, providing the highest level of system access. From this privileged position, intruders can freely read, modify, or delete any data managed by ACC.
The potential impact is significant, as ASUS Control Center is designed for centralized management of numerous servers, PCs, and workstations within corporate environments. A single compromised ACC instance could therefore provide attackers with remote control over an entire organization's IT infrastructure.
The vulnerability affects all versions of ASUS Control Center Enterprise up to and including version 4.0.0.2. ASUS strongly advises all organizations utilizing the software to update immediately to version 3.1.0.9 or a later release. Further details regarding the fix and its implementation can be found on ASUS's official Security Advisory page.
For organizations unable to apply the patch immediately, ASUS recommends implementing interim safeguards. These include isolating ACC management interfaces from public networks, blocking inbound and outbound traffic on port 2222, and conducting thorough audits of hosts for any unexpected SSH listeners. These measures can help mitigate the risk of exploitation while a permanent solution is deployed.