The vulnerability is an exposed IOCTL in ASUS System Control Interface that lacks proper access control, permitting a local low‑privileged user to issue crafted device control requests and read or write arbitrary physical memory. This flaw allows an attacker to overwrite any portion of memory, potentially executing arbitrary code or extracting secret data, leading to full compromise of the affected system. The weakness corresponds to CWE‑782.

Affected product is ASUS System Control Interface, a driver component found on ASUS server or desktop products. The list of CPE indicates the generic product family, but specific model or firmware revisions affected are not disclosed. Any device running the vulnerable driver version that exposes the IOCTL endpoint is susceptible; users should verify their hardware firmware against the ASUS security advisory.

The CVSS base score of 8.5 indicates high severity and the attack is local, requiring the attacker to already have a user account on the machine. EPSS is unavailable, so the current likelihood cannot be quantified, but the absence of KEV inclusion suggests no confirmed exploitation at this time. Nevertheless, an attacker with local execution privileges can exploit the flaw immediately, as the driver exposes memory operations without authentication. This makes the risk tangible for systems with unrestricted local user access.