Another flaw in ASUS Armoury Crate mainboard update system enables System-level privilege escalation
Take action: If you are running an ASUS mainboard on your computer, update the Armory Crate software. The exploit chain is complicated, but hackers have found a way to abuse it before, so they will find a way to abuse it again.
Learn More
ASUS has patched an authorization bypass vulnerability in Armoury Crate, its centralized system management software for Windows. Armoury Crate serves as ASUS's official system control software, providing a centralized interface to control RGB lighting through Aura Sync, adjust fan curves, manage performance profiles and ASUS peripherals, as well as download drivers and firmware updates. To perform these low-level system functions and provide comprehensive system monitoring, the software suite utilizes kernel drivers to access and control hardware features.
The vulnerability is tracked as CVE-2025-3464 (CVSS score 8.8) and stems from the AsIO3.sys driver component within Armoury Crate, affecting the Asusgio3 device that the driver creates. The vulnerability exists in how the driver verifies calling applications, relying on a hardcoded SHA-256 hash of AsusCertService.exe and a process ID allowlist instead of operating system-level access controls.
An attacker can create a hard link from a benign test application to a fake executable. The attacker launches the application, pauses execution, and then swaps the hard link to point to the legitimate AsusCertService.exe binary. When the driver performs its security check by verifying the file's SHA-256 hash, it reads the now-linked trusted binary, allowing the malicious test application to bypass authorization controls and gain unauthorized access to the driver. This bypass grants the attacker extensive low-level system privileges, including direct access to physical memory, input/output ports, and model-specific registers (MSRs), effectively opening a pathway to complete operating system compromise.
The vulnerability affects Armoury Crate versions between 5.9.9.0 and 6.1.18.0. The vulnerability requires an attacker to already have some level of access to the target system through methods such as malware infection, phishing campaigns, or compromised unprivileged accounts.
This is a second report of a similar vulnerability in the ASUS Armory Crate this year.
ASUS strongly recommends that all users immediately update their Armoury Crate installations to the latest available version. Users can obtain the security update by opening the Armoury Crate application and navigating to "Settings" > "Update Center" > "Check for Updates," then clicking "Update" when the new version becomes available.
