The flaw is a missing authorization check that permits a local attacker to write content to a specific file or registry location, or to trigger a recoverable system crash, through the Armoury Crate service's inter‑process interface. This omission is classified as CWE‑862 and enables a local user with sufficient access to bypass security controls and alter protected data or disrupt availability. The impact is that an attacker who can execute code locally can gain a higher privilege level, possibly Local System, and modify system state or cause service interruption.

The vulnerability affects all current installations of ASUS Armoury Crate on Windows systems. No specific version range is listed, so the issue applies broadly to any Armoury Crate release that includes the unprotected IPC interface. All users running the Armoury Crate application through the exposed service are potentially impacted.

The CVSS score of 6.9 indicates moderate severity; an EPSS score is not available, so the exploitation probability remains uncertain. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed exploitation is documented yet. The likely attack vector is a local attacker who can run code on the affected system and exploit the IPC interface. Because the vulnerability permits escalation to Local System privileges, the attacker could affect system integrity and availability. Monitoring for unusual registry writes or service restarts is advisable.