Critical severity · published May 9, 2025
CVE-2025-3463
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow…
9.4
CVSS
0.8%
EPSS
No
On KEV
Description
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests.
Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
DriverHub · ASUS
before 1.0.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3463
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3463
www.asus.com
https://www.asus.com/content/asus-product-security-advisory/
mrbruh.com
https://mrbruh.com/asusdriverhub/
More from DriverHub
8.4
CVE-2025-3462
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized…
5.4
CVE-2026-1880
An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protection of required…