An incorrectly assigned permission allows local users to elevate to SYSTEM through a crafted RPC call, leading to arbitrary code execution. This flaw stems from improper permission checks, classified as CWE-732. The consequence is that a local attacker can gain full control of the affected system, compromising confidentiality, integrity, and availability.

The flaw is present in ASUS System Control Interface, as identified in the ASUS Security Advisory. No specific version range is enumerated in the advisory, so all deployments of the product may be affected until the vendor issues a fix.

The CVSS score of 7.3 signals a high-risk vulnerability requiring prompt remediation. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog; thus the exploitation probability is uncertain but the local attacker can execute privileged code. Immediate patching or disabling the vulnerable RPC endpoint is recommended to mitigate the risk.