CVE-2026-3428

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3428", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "state": "PUBLISHED", "assignerShortName": "ASUS", "dateReserved": "2026-03-02T09:30:08.780Z", "datePublished": "2026-04-16T02:02:41.534Z", "dateUpdated": "2026-04-16T12:31:27.657Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2026-04-16T02:02:41.534Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}], "affected": [{"vendor": "ASUS", "product": "Member Center(\u534e\u7855\u5927\u5385)", "versions": [{"status": "affected", "version": "1.6.6.4 and earlier"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(\u534e\u7855\u5927\u5385) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download, and subsequently executed with administrative privileges upon user consent.\nRefer to the 'Security Update for ASUS Member Center' section on the ASUS Security Advisory for more information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(\u534e\u7855\u5927\u5385) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download, and subsequently executed with administrative privileges upon user consent.<br><p>Refer to the '<span>Security Update for ASUS Member Center</span><span>' section on the ASUS Security Advisory for more information.</span></p>"}]}], "references": [{"url": "https://www.asus.com/security-advisory/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T12:22:12.809026Z", "id": "CVE-2026-3428", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:31:27.657Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3428", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T12:22:12.809026Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:22:13.851Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUS", "product": "Member Center(\u534e\u7855\u5927\u5385)", "versions": [{"status": "affected", "version": "1.6.6.4 and earlier"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.asus.com/security-advisory/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(\u534e\u7855\u5927\u5385) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download, and subsequently executed with administrative privileges upon user consent.\nRefer to the 'Security Update for ASUS Member Center' section on the ASUS Security Advisory for more information.", "supportingMedia": [{"type": "text/html", "value": "A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(\u534e\u7855\u5927\u5385) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download, and subsequently executed with administrative privileges upon user consent.<br><p>Refer to the '<span>Security Update for ASUS Member Center</span><span>' section on the ASUS Security Advisory for more information.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2026-04-16T02:02:41.534Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3428", "state": "PUBLISHED", "dateUpdated": "2026-04-16T12:31:27.657Z", "dateReserved": "2026-03-02T09:30:08.780Z", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "datePublished": "2026-04-16T02:02:41.534Z", "assignerShortName": "ASUS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Member Center(\u534e\u7855\u5927\u5385)", "vendor": "ASUS", "versions": [{"status": "affected", "version": "1.6.6.4 and earlier"}]}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(\u534e\u7855\u5927\u5385) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download, and subsequently executed with administrative privileges upon user consent.\nRefer to the 'Security Update for ASUS Member Center' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Una vulnerabilidad de Descarga de C\u00f3digo Sin Verificaci\u00f3n de Integridad en los m\u00f3dulos de actualizaci\u00f3n en ASUS Member Center(????) permite a un usuario local lograr escalada de privilegios a Administrador mediante la explotaci\u00f3n de un Time-of-check Time-of-use (TOC-TOU) durante el proceso de actualizaci\u00f3n, donde una carga \u00fatil inesperada se sustituye por una leg\u00edtima inmediatamente despu\u00e9s de la descarga, y posteriormente se ejecuta con privilegios administrativos tras el consentimiento del usuario.\nConsulte la secci\u00f3n \u2019Security Update for ASUS Member Center\u2019 en el Aviso de Seguridad de ASUS para m\u00e1s informaci\u00f3n."}], "id": "CVE-2026-3428", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3428", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T12:22:12.809026Z", "version": "2.0.3"}}]}, "published": "2026-04-16T03:16:26.937", "references": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "url": "https://www.asus.com/security-advisory/"}], "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-494"}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6.6.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Member Center(\u534e\u7855\u5927\u5385)", "source": "cna", "vendor": "ASUS"}, "product": "member_center", "vendor": "asus"}], "analysis": {"en": {"generated_at": "2026-04-16T09:01:34.006530+00:00", "value": {"mitigation_remediation": ["Download and install the security update for ASUS Member Center from the official ASUS Security Advisory.", "Verify the integrity of the update package by checking the publisher\u2019s digital signature or checksum before installation.", "Configure the system to reject unsigned or altered update files, and consider disabling automatic updates for this application until the issue is fully addressed."], "summary": {"action": "Patch Now", "impact": "Privilege Escalation to Administrator"}, "threat_synthesis": {"affected_systems": "The affected product is ASUS Member Center (\u534e\u7855\u5927\u5385). No specific version information is supplied; the issue applies to installations of the update modules that perform unchecked download and execution of update files.", "description_and_impact": "A vulnerability in the ASUS Member Center update modules allows a local user to replace a legitimate firmware component with a malicious payload immediately after download, exploiting a Time\u2011of\u2011check Time\u2011of\u2011use condition. The replacement is executed with administrator privileges following the user\u2019s consent, giving the attacker control over the system. The flaw is a download of code without integrity checking, mapping to CWE\u2011367 and CWE\u2011494.", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in KEV, suggesting no known exploits in the wild yet. Exploitation requires a local user with permission to trigger an update and to give consent, making it a local privilege escalation scenario. If the vulnerability remains unpatched, an attacker could execute arbitrary code with administrative privileges on the affected system."}}}}, "created": "2026-04-16T09:12:00.385302+00:00", "title": "Local Privilege Escalation via Unverified Update Payload in ASUS Member Center", "updated": "2026-04-16T09:15:30.974352+00:00", "vendors": ["asus", "asus$PRODUCT$member_center"]}