A vulnerability in the ASUS Member Center update modules allows a local user to replace a legitimate firmware component with a malicious payload immediately after download, exploiting a Time‑of‑check Time‑of‑use condition. The replacement is executed with administrator privileges following the user’s consent, giving the attacker control over the system. The flaw is a download of code without integrity checking, mapping to CWE‑367 and CWE‑494.

The affected product is ASUS Member Center (华硕大厅). No specific version information is supplied; the issue applies to installations of the update modules that perform unchecked download and execution of update files.

The CVSS score of 5.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in KEV, suggesting no known exploits in the wild yet. Exploitation requires a local user with permission to trigger an update and to give consent, making it a local privilege escalation scenario. If the vulnerability remains unpatched, an attacker could execute arbitrary code with administrative privileges on the affected system.