Two flaws in DriverHub, a driver software that comes pre-installed on Asus motherboards, can be remotely exploited to execute arbitrary code, according to New Zealand security researcher 'MrBruh'.
See also: Critical RCE vulnerability detected in Ivanti VPN devices
The issues, identified as CVE-2025-3462 (CVSS score 8.4) and CVE-2025-3463 (CVSS score 9.4), could be exploited via specially crafted HTTP requests to interact with DriverHub.
According to Asus, the DriverHub security flaws are due to insufficient validation and can be used to modify software functionality or affect system behavior. The company emphasizes that “ laptops, desktops, or other end devices ” are not affected by these bugs.
However, MrBruh explains that these security flaws can be exploited for remote code execution, as they relate to the way pre-installed software receives and executes packages.
DriverHub runs in the background and communicates with the driverhub.asus.com to notify users of recommended or required drivers to install or update. It is based on the Remote Procedure Call (RPC) protocol and hosts a local servicethat the website can connect to via API requests.
See also: Windows Remote Desktop vulnerability allows RCE execution
According to MrBruh, while DriverHub only accepts RPC requests from driverhub.asus.com, it is possible to bypass this restriction by changing the origin to 'driverhub.asus.com.*', thus allowing an unauthorized user to send requests.
Additionally, DriverHub's UpdateApp endpoint accepts specially formatted URL parameters (as long as they contain the string '.asus.com'), saves files with a specified name, downloads any file with any extension, automatically executes signed files with administrator privileges , and does not delete files that fail digital signature verification.
While analyzing a standalone Wi-Fi driver distributed via ZIP file, MrBruh discovered that it is possible to target the UpdateApp endpoint with an exploit that leverages the silent install feature to execute any file.
The researcher demonstrated how the vulnerabilities can be exploited for remote code execution with a single click, simply by convincing the target user to visit a malicious website hosted on a subdomain like driverhub.asus.com.*.
See also: Very serious RCE vulnerability discovered in Apache Parquet
Relatedly, vulnerabilities of this type—which allow remote code execution via seemingly trusted subdomains—fall under the category of so-called “subdomain takeover attacks.” These attacks exploit neglected or misconfigured DNS records to create a false sense of security for users, since the domain appears to belong to the manufacturer (e.g. *.asus.com), but is actually controlled by the attacker.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
