High severity · published Jul 26, 2023
CVE-2023-26911
ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Armoury Crate · Asus
through 5.3.4.0 · source: NVD
SE
Setupasusservices · Asus
through 1.0.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26911
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26911
Third Party Advisory
https://irradiate.com.au/blog/CVE-2023-26911
More from Armoury Crate
9.8
CVE-2023-5716
ASUS Armoury Crate - Arbitrary File Write
8.5
CVE-2026-102438
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link…
8.5
CVE-2025-9968
A link following vulnerability exists in the UnifyScanner component of Armoury Crate
8.4
CVE-2025-3464
A race condition vulnerability exists in Armoury Crate
8.4
CVE-2024-12957
A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion