ASUS Control Center Express Agent Missing Authentication Remote Code Execution Vulnerability

September 10th, 2026
ZDI-26-657 ZDI-CAN-29986

CVE ID

CVE-2026-19397

CVSS Score

9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

ASUS

Affected Products

Control Center Express

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ASUS Control Center Express Agent. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Remote Desktop endpoint, which listens on TCP port 10637 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the user logged on at the console of the target machine.

Additional Details

ASUS has issued an update to correct this vulnerability. More details can be found at:
https://www.asus.com/security-advisory

Disclosure Timeline

  • 2026-06-09 - Vulnerability reported to vendor
  • 2026-09-10 - Coordinated public release of advisory
  • 2026-09-10 - Advisory Updated

Credit

0x0dee

Back to Advisories