CVE-2019-25764

highpriority · track · 0EPSS 0.001 · 2 %ileEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.12% (2nd) EPSS
CVSS 7 · high
Is it mine?
3 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_it

EPSS · scored 2026-10-28

**UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedAURA SYNCcisa_csaf_it

    ASUS recommends that users check whether a newer version of their installed ASUS software (e.g., Aura Sync, AI Suite 3) is available, and update to the latest version to ensure the affected legacy drivers are no longer in use.

    https://www.asus.com/security-advisory
02

cvss

Technical severity, 0–10. One row per scoring source.

7.3
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v4.07.3highCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.07.3highCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-782USCWE-782US
05

affected products (3)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VA-26-202-01ASUS AURA SYNC driver local privilege escalation2026-07-21csaf · cisa_csaf_itUS

    Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_itNVDCVE.orgMITRE
published 2026-07-17modified 2026-07-17
09

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan