CVE-2025-13348 | THREATINT

Description

An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered by a local user sending a specially crafted request, potentially leading to the creation of arbitrary files in a specified path. Refer to the "Security Update for ASUS Business Manager" section on the ASUS Security Advisory for more information.

PUBLISHED Reserved 2025-11-18 | Published 2026-02-02 | Updated 2026-02-02 | Assigner ASUS

HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-862 Missing Authorization

Product status

Default status

unaffected

Any version before 3.0.37.0

affected

References

www.asus.com/security-advisory/ vendor-advisory

cve.org (CVE-2025-13348)

nvd.nist.gov (CVE-2025-13348)

Download JSON