Technical impact
A flaw in the initialization logic of certain ASUS motherboards allows a user with close physical proximity to read or write arbitrary memory by inserting a specially crafted device. This improper initialization (CWE-665) can be leveraged to alter firmware state or sensitive data, potentially granting elevated privileges on the affected system. The vulnerability does not require network access or user credentials, but it does require that a malicious component is physically connected to the board during power‑on or reset. The capability to modify memory can lead to denial of service, data corruption, or further exploitation such as installing persistent malware in the firmware.
Affected Systems
Affected products include a range of ASUS motherboards: PRIME Z390-A, PRIME Z390-A/H10, Pro WS C246-ACE, ROG Maximus XI Apex/Code/Extreme/Formula/Gene/Hero (Wi‑Fi), ROG Strix Z390‑E Gaming, ROG Strix Z390‑F Gaming, and WS Z390 Pro. All models shipped with firmware versions through the specified release dates are vulnerable; newer firmware releases may contain a fix.
Risk and Exploitability
The CVSS base score of 7 denotes high severity, and while the EPSS score is < 1%, indicating a low likelihood of exploitation, the lack of remote exploitation surface lowers the likelihood but still presents a serious threat to physically secure environments. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. Attackers need physical access and the ability to insert a specially crafted device, so environments with strict physical security controls are inherently protected. Nonetheless, in data centers or shared offices where device tampering is possible, the risk is non‑trivial, and timely patching is recommended.
