High severity · published Jun 16, 2025
CVE-2025-3464
A race condition vulnerability exists in Armoury Crate
8.4
CVSS
0.6%
EPSS
No
On KEV
Description
A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass.
Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Armoury Crate · ASUS
v5.9.9.0~v6.1.18 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3464
talosintelligence.com
https://talosintelligence.com/vulnerability_reports/TALOS-2025-2150
www.asus.com
https://www.asus.com/content/asus-product-security-advisory/
www.talosintelligence.com
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2150
More from Armoury Crate
9.8
CVE-2023-5716
ASUS Armoury Crate - Arbitrary File Write
8.5
CVE-2026-102438
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link…
8.5
CVE-2025-9968
A link following vulnerability exists in the UnifyScanner component of Armoury Crate
8.4
CVE-2024-12957
A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion
8.2
CVE-2025-1533
A stack buffer overflow has been identified in the AsIO3.sys driver