CVE-2026-15030

Local Out‑of‑Bounds Read via Crafted IOCTL in ASUS System Control Interface

Published Jul 15, 2026 CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Description

Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request that bypasses the validation.
Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

Analysis

Technical impact

This vulnerability is an out‑of‑bounds read (CWE‑125) that allows a local administrator to read memory regions beyond the intended firmware boundary by sending a crafted IOCTL request to the ASUS System Control Interface v3 or the Business Manager. The read can expose sensitive data that the firmware was designed to protect, potentially exposing confidential information held by the device.

Affected Systems

ASUS Business Manager, ASUS System Control Interface, and the v3 iteration of the System Control Interface are affected. No specific firmware or hardware revision numbers are provided, so any current installation of these components is considered vulnerable. The issue is limited to devices running the impacted ASUS firmware modules.

Risk and Exploitability

The CVSS score of 5.6 marks this as a moderate‑severity local disclosure. The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread active attacks. Exploitation requires local administrative access to the device and the ability to send a crafted IOCTL request to the vulnerable driver.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ASUS

System Control Interface v3

unaffected

Version	Status	Constraints
`before v3.1.65.0`	affected	—

ASUS

System Control Interface

unaffected

Version	Status	Constraints
`before v1.1.40.0`	affected	—

ASUS

Business Manager

unaffected

Version	Status	Constraints
`through v3.0.38.0`	affected	—

No data.

Vendor Product Versions

Asus

Business Manager

Version	Status	Scheme	Platform
`[0,v3.0.38.0]`	affected	generic	—

Asus

System Control Interface

Version	Status	Scheme	Platform
`[0,v1.1.40.0)`	affected	generic	—

Asus

System Control Interface V3

Version	Status	Scheme	Platform
`[0,v3.1.65.0)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Download and install the latest security update for ASUS System Control Interface and Business Manager as released by ASUS.
Configure the system to restrict the vulnerable IOCTL so that it can only be accessed by trusted applications or requires higher‑level authentication.
Apply least‑privilege principles by limiting local administrator accounts to personnel who absolutely need them.

Generated by OpenCVE AI on August 1, 2026 at 09:02 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.137% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.asus.com/security-advisory

History

Sep 17, 2026 9:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 17, 2026 9:00 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:asus:business_manager:::::::: cpe:2.3:a:asus:system_control_interface:::::::: cpe:2.3:a:asus:system_control_interface_v3::::::::	cpe:2.3:a:asus:business_manager:through_v3.0.38.0:::::::* cpe:2.3:a:asus:system_control_interface:before_v1.1.40.0:::::::* cpe:2.3:a:asus:system_control_interface_v3:before_v3.1.65.0:::::::*

Aug 1, 2026 9:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Local Out‑of‑Bounds Read via Crafted IOCTL in ASUS System Control Interface

Jul 28, 2026 4:00 AM Title updated View changes

Type	Values Removed	Values Added
Title	Local Administrator Out-of-Bounds Read in ASUS System Control Interface

Jul 22, 2026 9:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Local Administrator Out-of-Bounds Read in ASUS System Control Interface

Jul 17, 2026 6:15 AM Title updated View changes

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in ASUS System Control Interface Leading to Local Memory Disclosure

Jul 16, 2026 1:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in ASUS System Control Interface Leading to Local Memory Disclosure

Jul 15, 2026 2:15 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request that bypasses the validation. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.
First Time appeared		Asus Asus business Manager Asus system Control Interface Asus system Control Interface V3
Weaknesses		CWE-125
CPEs		cpe:2.3:a:asus:business_manager:::::::: cpe:2.3:a:asus:system_control_interface:::::::: cpe:2.3:a:asus:system_control_interface_v3::::::::
Vendors & Products		Asus Asus business Manager Asus system Control Interface Asus system Control Interface V3
References		https://www.asus.com/security-advisory
Metrics		cvssV4_0 `{'score': 5.6, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`