TI-2025-10912 Aliases CVE-2025-11901 GHSA-pcxq-4x45-227m

Improper access control in ASUS B460 series

LOW 32CWE-284Published 2025-12-17 · Updated 2025-12-17

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA). Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00229 13th percentileScored 2026-11-07

Fix Fixed H470 series (ASUS): 3002H610 series (ASUS): 3810

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ASUS	B460 series	before 1805, 2002, 3002	—	No fix listed	CNA
ASUS	B560 series	before 2402, 2803	—	No fix listed	CNA
ASUS	B660 series	before 3810, 4501	—	No fix listed	CNA
ASUS	B760 series	before 1825, 3102	—	No fix listed	CNA
ASUS	H410 series	before 1805, 2002	—	No fix listed	CNA
ASUS	H470 series	before 3002	3002	Patch available	CNA
ASUS	H510 series	before 2402, 2803	—	No fix listed	CNA
ASUS	H610 series	before 3810	3810	Patch available	CNA
ASUS	W480 series	before 1002, 2603, 3302	—	No fix listed	CNA
ASUS	W680 series	before 2015, 2701, 4501	—	No fix listed	CNA
ASUS	Z590 series	before 2402, 2803	—	No fix listed	CNA
ASUS	Z690 series	before 3810, 4501	—	No fix listed	CNA
ASUS	Z790 series	before 1825, 2102, 3102	—	No fix listed	CNA

B460 series VendorASUS Affected before 1805, 2002, 3002 Fixed in — No fix listed CNA
B560 series VendorASUS Affected before 2402, 2803 Fixed in — No fix listed CNA
B660 series VendorASUS Affected before 3810, 4501 Fixed in — No fix listed CNA
B760 series VendorASUS Affected before 1825, 3102 Fixed in — No fix listed CNA
H410 series VendorASUS Affected before 1805, 2002 Fixed in — No fix listed CNA
H470 series VendorASUS Affected before 3002 Fixed in 3002 Patch available CNA
H510 series VendorASUS Affected before 2402, 2803 Fixed in — No fix listed CNA
H610 series VendorASUS Affected before 3810 Fixed in 3810 Patch available CNA
W480 series VendorASUS Affected before 1002, 2603, 3302 Fixed in — No fix listed CNA
W680 series VendorASUS Affected before 2015, 2701, 4501 Fixed in — No fix listed CNA
Z590 series VendorASUS Affected before 2402, 2803 Fixed in — No fix listed CNA
Z690 series VendorASUS Affected before 3810, 4501 Fixed in — No fix listed CNA
Z790 series VendorASUS Affected before 1825, 2102, 3102 Fixed in — No fix listed CNA

Remediation

Fix · CNA H470 series (ASUS) Fixed in 3002
Fix · CNA H610 series (ASUS) Fixed in 3810

Timeline

2026-10-02 Threatist record created from CVE-2025-11901
2026-10-03 Alias added: GHSA-pcxq-4x45-227m

References

Advisory 1

https://www.asus.com/security-advisory/

TI-2021-12008 The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra… KEVCVSS 3.1CRITICAL 9.8
TI-2025-36933 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were… KEVCVSS 4.0CRITICAL 9.3
TI-2023-20780 OS command injection in ASUS RT-AX55 KEVCVSS 3.1HIGH 8.8
TI-2018-04367 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. CVSS 3.0CRITICAL 9.8
TI-2018-04368 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. CVSS 3.0CRITICAL 9.8
TI-2014-07780 common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and… CVSS 2.0HIGH 10.0

See all 365 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences