Medium severity · published Mar 12, 2026
CVE-2025-15037
An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver
6.8
CVSS
0.1%
EPSS
No
On KEV
Description
An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially crafted IOCTL request, potentially leading to unauthorized access to sensitive hardware resources and kernel information disclosure. Refer to the "ASUS Business System Control Interface" section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
ASUS Business System Control Interface · ASUS
before 0.5.14.0 · source: vendor
Affected product
AB
ASUS Business System Control Interface
ASUS
More from ASUS Business System Control Interface
6.9
CVE-2025-15038
An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver