CVE-2023-5716

The vulnerability consists of a lack of proper permission verification (CWE-306) before handling HTTP requests directed to the ASUS Armoury Crate application component. An attacker can send specific HTTP requests without authentication, which allows arbitrary reading or modification of files on the file system of the machine running the software. The lack of an access control mechanism means that any remote network entity can perform these operations.

An attacker can read confidential system or user files (breach of confidentiality), as well as write or modify arbitrary files (breach of integrity and potentially availability), which could consequently lead to complete system takeover.

Patches available from the vendor should be applied according to the references (https://www.twcert.org.tw/tw/cp-132-7666-fffce-1.html). Until updates are applied, it is recommended to restrict network access to ports used by ASUS Armoury Crate at the firewall level and avoid running the application on systems directly exposed to untrusted networks.

ASUS Armoury Crate — versions indicated in the vendor's references