CVE-2025-11901

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11901", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "state": "PUBLISHED", "assignerShortName": "ASUS", "dateReserved": "2025-10-17T06:47:40.071Z", "datePublished": "2025-12-17T04:23:51.784Z", "dateUpdated": "2025-12-17T21:46:24.887Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "B460 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1805, 2002, 3002"}]}, {"defaultStatus": "unaffected", "product": "B560 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "B660 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810, 4501"}]}, {"defaultStatus": "unaffected", "product": "B760 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1825, 3102"}]}, {"defaultStatus": "unaffected", "product": "H410 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1805, 2002"}]}, {"defaultStatus": "unaffected", "product": "H470 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3002"}]}, {"defaultStatus": "unaffected", "product": "H510 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "H610 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810"}]}, {"defaultStatus": "unaffected", "product": "W480 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1002, 2603, 3302"}]}, {"defaultStatus": "unaffected", "product": "W680 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2015, 2701, 4501"}]}, {"defaultStatus": "unaffected", "product": "Z590 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "Z690 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810, 4501"}]}, {"defaultStatus": "unaffected", "product": "Z790 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1825, 2102, 3102"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Mohamed Al-Sharifi & Nick Peterson"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using<span style=\"background-color: rgb(255, 255, 255);\">&nbsp;Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets</span><span style=\"background-color: rgb(255, 255, 255);\">. </span>Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).<br>Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.\n\n<br>"}], "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u00a0Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "baseScore": 7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2025-12-17T04:23:51.784Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.asus.com/security-advisory/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-17T21:46:16.833758Z", "id": "CVE-2025-11901", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T21:46:24.887Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11901", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-17T21:46:16.833758Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T21:46:20.739Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Mohamed Al-Sharifi & Nick Peterson"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUS", "product": "B460 series", "versions": [{"status": "affected", "version": "before 1805, 2002, 3002"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "B560 series", "versions": [{"status": "affected", "version": "before 2402, 2803"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "B660 series", "versions": [{"status": "affected", "version": "before 3810, 4501"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "B760 series", "versions": [{"status": "affected", "version": "before 1825, 3102"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "H410 series", "versions": [{"status": "affected", "version": "before 1805, 2002"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "H470 series", "versions": [{"status": "affected", "version": "before 3002"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "H510 series", "versions": [{"status": "affected", "version": "before 2402, 2803"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "H610 series", "versions": [{"status": "affected", "version": "before 3810"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "W480 series", "versions": [{"status": "affected", "version": "before 1002, 2603, 3302"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "W680 series", "versions": [{"status": "affected", "version": "before 2015, 2701, 4501"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "Z590 series", "versions": [{"status": "affected", "version": "before 2402, 2803"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "Z690 series", "versions": [{"status": "affected", "version": "before 3810, 4501"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "Z790 series", "versions": [{"status": "affected", "version": "before 1825, 2102, 3102"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.asus.com/security-advisory/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u00a0Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.", "supportingMedia": [{"type": "text/html", "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using<span style=\"background-color: rgb(255, 255, 255);\">&nbsp;Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets</span><span style=\"background-color: rgb(255, 255, 255);\">. </span>Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).<br>Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2025-12-17T04:23:51.784Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11901", "state": "PUBLISHED", "dateUpdated": "2025-12-17T21:46:24.887Z", "dateReserved": "2025-10-17T06:47:40.071Z", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "datePublished": "2025-12-17T04:23:51.784Z", "assignerShortName": "ASUS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "B460 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1805, 2002, 3002"}]}, {"defaultStatus": "unaffected", "product": "B560 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "B660 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810, 4501"}]}, {"defaultStatus": "unaffected", "product": "B760 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1825, 3102"}]}, {"defaultStatus": "unaffected", "product": "H410 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1805, 2002"}]}, {"defaultStatus": "unaffected", "product": "H470 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3002"}]}, {"defaultStatus": "unaffected", "product": "H510 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "H610 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810"}]}, {"defaultStatus": "unaffected", "product": "W480 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1002, 2603, 3302"}]}, {"defaultStatus": "unaffected", "product": "W680 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2015, 2701, 4501"}]}, {"defaultStatus": "unaffected", "product": "Z590 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "Z690 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810, 4501"}]}, {"defaultStatus": "unaffected", "product": "Z790 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1825, 2102, 3102"}]}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u00a0Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Una vulnerabilidad de consumo de recursos no controlado afecta a ciertas placas base ASUS que utilizan chipsets de la serie Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680. La explotaci\u00f3n requiere acceso f\u00edsico a las ranuras de expansi\u00f3n internas para instalar un dispositivo especialmente dise\u00f1ado y una utilidad de software de soporte, y puede conducir a un consumo de recursos no controlado que aumenta el riesgo de acceso directo a memoria (DMA) no autorizado.\nConsulte la secci\u00f3n 'Actualizaci\u00f3n de seguridad para firmware UEFI' en el Aviso de Seguridad de ASUS para obtener m\u00e1s informaci\u00f3n."}], "id": "CVE-2025-11901", "lastModified": "2026-10-07T11:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11901", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-17T21:46:16.833758Z", "version": "2.0.3"}}]}, "published": "2025-12-17T05:16:10.793", "references": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "url": "https://www.asus.com/security-advisory/"}], "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}]}

{}

{"created": "2025-12-17T14:28:39.580321+00:00", "updated": "2025-12-17T14:28:39.580347+00:00", "vendors": ["asus", "asus$PRODUCT$b460", "asus$PRODUCT$b560", "asus$PRODUCT$b660", "asus$PRODUCT$b760", "asus$PRODUCT$h410", "asus$PRODUCT$h470", "asus$PRODUCT$h510", "asus$PRODUCT$h610", "asus$PRODUCT$w480", "asus$PRODUCT$w680", "asus$PRODUCT$z590", "asus$PRODUCT$z690", "asus$PRODUCT$z790"]}