During the ASUS DriverHub update process, an incorrect permission assignment permits a local user to modify a critical resource protected by elevated privileges. The altered resource bypasses system checks and executes with higher privileges when a user initiates an update. This flaw enables an attacker who can run DriverHub on the host to gain non‑privileged upgrades that run under elevated rights, effectively compromising the entire system without requiring remote exploitation.

All ASUS DriverHub installations are potentially vulnerable. The advisory does not specify impacted versions; any existing installation that has not applied the security update can be affected. No additional vendor product absence is noted.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not available, so expected exploitation frequency is unknown. The flaw requires local user access to execute DriverHub and to initiate an update. If an attacker can manipulate the update package, they may achieve privilege escalation at the time of the update. The vulnerability is not listed in CISA’s KEV catalog, and no advance warning or public exploitation evidence is documented at this time.