High severity · published Nov 25, 2025
CVE-2025-59373
A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface
8.5
CVSS
0.1%
EPSS
No
On KEV
Description
A local privilege escalation vulnerability exists in
the restore mechanism of
ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM.
For more information, please refer to section Security Update for MyASUS in the ASUS Security Advisory.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
MyASUS · ASUS
before 3.1.48.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59373
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59373
www.asus.com
https://www.asus.com/content/security-advisory/
More from MyASUS
9.8
CVE-2022-22814
The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation
7.8
CVE-2025-12793
An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent
7.7
CVE-2025-4569
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services
6.9
CVE-2025-4570
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services