CVE-2025-4570

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-4570", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "state": "PUBLISHED", "assignerShortName": "ASUS", "dateReserved": "2025-05-12T09:02:57.366Z", "datePublished": "2025-07-21T07:52:00.800Z", "dateUpdated": "2025-07-22T02:15:20.471Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MyASUS", "vendor": "ASUS", "versions": [{"status": "affected", "version": "4.0.35.0 and earlier"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "MrBruh"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An insecure sensitive key storage issue was found in MyASUS.&nbsp;potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services.<br>\n\nRefer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information.\n\n<br>"}], "value": "An insecure sensitive key storage issue was found in MyASUS.\u00a0potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services.\n\n\nRefer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2025-07-22T02:15:20.471Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.asus.com/content/security-advisory/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-21T17:32:19.471208Z", "id": "CVE-2025-4570", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T17:35:33.999Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4570", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-21T17:32:19.471208Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T17:34:52.441Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "MrBruh"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUS", "product": "MyASUS", "versions": [{"status": "affected", "version": "4.0.35.0 and earlier"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.asus.com/content/security-advisory/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An insecure sensitive key storage issue was found in MyASUS.\u00a0potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services.\n\n\nRefer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information.", "supportingMedia": [{"type": "text/html", "value": "An insecure sensitive key storage issue was found in MyASUS.&nbsp;potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services.<br>\n\nRefer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information.\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2025-07-22T02:15:20.471Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4570", "state": "PUBLISHED", "dateUpdated": "2025-07-22T02:15:20.471Z", "dateReserved": "2025-05-12T09:02:57.366Z", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "datePublished": "2025-07-21T07:52:00.800Z", "assignerShortName": "ASUS"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MyASUS", "vendor": "ASUS", "versions": [{"status": "affected", "version": "4.0.35.0 and earlier"}]}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An insecure sensitive key storage issue was found in MyASUS.\u00a0potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services.\n\n\nRefer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Se detect\u00f3 un problema de almacenamiento de claves confidenciales inseguro en MyASUS, lo que podr\u00eda permitir que un usuario no autorizado obtenga un token para comunicarse con ciertos servicios. Consulte la secci\u00f3n \"Actualizaci\u00f3n de seguridad para MyASUS\" en el Aviso de seguridad de ASUS para obtener m\u00e1s informaci\u00f3n."}], "id": "CVE-2025-4570", "lastModified": "2026-06-17T09:33:32.563", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4570", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-21T17:32:19.471208Z", "version": "2.0.3"}}]}, "published": "2025-07-21T08:15:24.270", "references": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "url": "https://www.asus.com/content/security-advisory/"}], "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}]}

{}

{"created": "2025-07-22T10:01:23.345871+00:00", "updated": "2025-07-22T10:01:23.345945+00:00", "vendors": ["asus", "asus$PRODUCT$myasus"]}