The vulnerability is a permissive cross‑domain security policy that permits requests from any domain. This is an instance of CWE‑942, where untrusted input is used to construct a server request. Because the GameSDK service accepts requests containing UNC paths from any domain, an attacker can craft a malicious web page that convinces a user to visit it. The page may then cause the local service to request a UNC path that includes the victim’s NTLM hash, enabling the attacker to obtain those credentials. Credential theft can lead to data tampering, service disruption, and lateral movement across other systems accessed with those credentials.

All ASUS GameSDK installations are potentially affected, as no specific version constraints were provided in the advisory. The vulnerability arises from the default cross‑domain configuration rather than a particular build.

The CVSS score of 7.2 indicates a high‑severity weakness. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV. The attack requires a user to visit a crafted webpage, so it is an indirect remote attack that relies on user interaction. Once executed, the attacker can retrieve NTLM credentials and possibly tamper with data or take the application offline.