Asus on Monday announced patches for a high-severity vulnerability in the Armoury Crate management software that could lead to full system compromise.
Tracked as CVE-2025-3464 (CVSS score of 8.8), the bug is described as an authorization bypass rooted in a Time-of-check Time-of-use issue.
According to Cisco Talos, which identified the flaw, an attacker can trigger the security defect by creating a crafted hard link and bypass authorization to an Armoury Crate-specific driver.
A centralized application, Armoury Crate is used for the management of hardware components and peripherals, offering various device configuration, driver and firmware update, RGB illumination, and system performance capabilities.
CVE-2025-3464 is related to the AsIO3.sys virtual driver that Armoury Crate uses for certain functionality, and the Asusgio3 device the driver creates.
For protection purposes, access to the driver is limited to the AsusCertService.exe and processes whose PIDs are added by it, and a matching SHA-256 hash.
However, Talos discovered that an attacker could create a hard link pointing to an executable in the same directory as AsusCertService.exe, which results in the function checking the SHA-256 hash reading the trusted binary, leading to authorization bypass.
“Due to the authorization bypass, any user can obtain a handle to the device, which exposes numerous functionalities critical from a security perspective,” Talos explains.
An attacker that already has access to a vulnerable device can exploit the vulnerability to map physical memory addresses, access I/O port communication instructions, read/write values from/to MSR register, and more.
“We believe that this vulnerability is critical and provides a potential attacker with numerous easy ways to escalate privileges and take control of the entire system,” Talos notes.
On Monday, Asus announced that CVE-2025-3464 impacts Armoury Crate versions between 5.9.9.0 and 6.1.18.0, urging users to update their installations to the latest version as soon as possible.
Related: High-Severity Vulnerabilities Patched in Tenable Nessus Agent
Related: GreyNoise Flags 9,000 ASUS Routers Backdoored Via Patched Vulnerability
Related: Asus DriverHub Vulnerabilities Expose Users to Remote Code Execution Attacks
