Read the docs
TI-2026-53031 Aliases CVE-2026-75754GHSA-v9r8-p5q7-mgmq

Missing authentication in ASUS Control Center Enterprise

Priority MEDIUM 49CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ASUSControl Center Enterprise (ACC)through 4.0.0.2—No fix listedCNA
  • Control Center Enterprise (ACC) VendorASUS Affected through 4.0.0.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75754
  2. 2026-10-03 Alias added: GHSA-v9r8-p5q7-mgmq

References

Other 1

  • TI-2021-12008 The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36933 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were… KEVCVSS 4.0CRITICAL 9.3
  • TI-2023-20780 OS command injection in ASUS RT-AX55 KEVCVSS 3.1HIGH 8.8
  • TI-2018-04367 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. CVSS 3.0CRITICAL 9.8
  • TI-2018-04368 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. CVSS 3.0CRITICAL 9.8
  • TI-2014-07780 common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and… CVSS 2.0HIGH 10.0
See all 365 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences