CYPHERLOCK, INC.

Vulnerability in Asus One-Click Tool Enabled Remote Code Execution

Vulnerability in Asus One-Click Tool Enabled Remote Code Execution

ASUS DriverHub Flaw Let Hackers Hijack PCs with a Single Click

A severe security loophole in ASUS’s DriverHub service exposed users to remote attacks, allowing harmful websites to run code as an administrator — all triggered by a single user interaction.

The vulnerability was uncovered by cybersecurity researcher Paul, known in the infosec community as “MrBruh,” based in New Zealand. ASUS has since released a fix to address the problem.

The flaw stemmed from two high-risk issues, logged as CVE-2025-3462 (CVSS 8.4) and CVE-2025-3463 (CVSS 9.4). These were tied to DriverHub, a system utility silently installed during the first boot on certain ASUS motherboards. Running quietly in the background over port 53000, DriverHub automates the task of detecting and downloading driver updates.

“Unlike typical apps, DriverHub doesn’t offer a visual interface,” MrBruh noted. “It’s essentially a background agent that talks to the ASUS update server at driverhub.asus.com.”

The exploit revolved around weak origin checks. While DriverHub was configured to trust requests only from its official domain, the system was tricked into accepting requests from any site whose domain included the official one. For example, a domain like driverhub.asus.com.mrbruh.com could bypass the security checks.

This oversight opened the door for attackers to launch remote code execution (RCE) attacks by embedding malicious scripts in seemingly trusted requests — turning a convenience tool into a silent attack vector.

Chained ASUS DriverHub Bug Gave Hackers Admin Access Through Malicious Updates

A critical oversight in the way ASUS’s DriverHub handled updates gave attackers a way to execute arbitrary code as an administrator — all by abusing a trusted process.

The core weakness centered on the UpdateApp endpoint, which failed to verify the authenticity of files it was instructed to download. This opened the door for a creative exploit chain:

  1. A user unknowingly lands on a malicious webpage hosted on a cleverly crafted subdomain that included the trusted string driverhub.asus.com.
  2. That page silently sends a request to the vulnerable UpdateApp interface to fetch a harmful file.
  3. Next, it delivers a tailored AsusSetup.ini configuration file. This file includes a key directive: SilentInstallRun=calc.exe — or any executable the attacker wants.
  4. The site then triggers the download of ASUS’s legitimate, digitally signed AsusSetup.exe.
  5. Because this executable is launched with the -s (silent) flag, it reads the malicious INI file — and runs the attacker’s code with full administrative privileges.

“ASUSSetup.exe starts by parsing AsusSetup.ini, which defines how the driver installation proceeds,” the researcher said. “When invoked with the silent mode flag, it blindly executes what’s defined in SilentInstallRun. DriverHub depends on this behavior to quietly install drivers — but it also became the point of compromise.”

Despite the severity, there’s no indication the flaw was actively exploited in real-world attacks prior to ASUS deploying a fix.

Summary of Security Vulnerabilities in ASUS DriverHub

Two high-severity vulnerabilities were identified in ASUS’s DriverHub utility, which is preinstalled on select ASUS motherboards. Both flaws could be exploited to achieve remote code execution (RCE) by tricking users into visiting a specially crafted malicious website.

CVE-2025-3462

  • Component Affected: ASUS DriverHub
  • Issue: Inadequate origin validation allowed unauthorized requests
  • Impact: Remote code execution with elevated privileges
  • Exploit Conditions: Requires user to access a malicious domain mimicking driverhub.asus.com; the attacker then sends tailored HTTP requests to the vulnerable endpoint
  • CVSS v3.1 Score: 8.4 (High)

CVE-2025-3463

  • Component Affected: ASUS DriverHub
  • Issue: Weak certificate verification enabled acceptance of spoofed requests
  • Impact: Remote code execution
  • Exploit Conditions: Identical to CVE-2025-3462 — an attacker exploits a malicious subdomain and manipulates HTTP traffic
  • CVSS v3.1 Score: 9.4 (Critical)

ASUS Urges Immediate Action to Address DriverHub Security Flaws

ASUS has issued a security advisory urging all users to apply the latest update to the DriverHub utility without delay. The update can be triggered by launching the DriverHub tool and selecting the “Update Now” option.

For users who do not actively rely on DriverHub, the service can be turned off entirely via BIOS settings. However, for those dependent on its driver management features, applying the fix is critical — the identified vulnerabilities could lead to full system takeover simply by visiting a compromised webpage.

This case underscores the broader risks associated with pre-installed vendor software that operates silently in the background. It also reinforces the need for vendors and users alike to prioritize timely patching when security flaws are discovered in low-visibility but high-privilege system tools.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day